Extracted

• • Target

    6acb2bcd36980972b24bf0530a4e18ce9ddf91c2e794287ba826353177f038e2

  • Size

    1.1MB

  • MD5

    e3f8a7c796b3a85cf91c58be37966ef4

  • SHA1

    a8616424d6436976bed32c5a00421b4d7dbce0f5

  • SHA256

    6acb2bcd36980972b24bf0530a4e18ce9ddf91c2e794287ba826353177f038e2

  • SHA512

    f849416b83e6f8d571355b08dddfd11abcef983367bafd92abd147c93696b1eb8b868e97f168b7ef075b34152cb1ed9c22ef0f9cd194a7b7b09fd0ff3d4ebdcc

  • SSDEEP

    24576:iNrNYoYB0gYjgKPK3VwV5k7j5awX300zQUGtZc:S+7Kd8KK3VwXgj5aEkHUGtZc

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    7KB

  • MD5

    675c4948e1efc929edcabfe67148eddd

  • SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

  • SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

  • SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

  • SSDEEP

    96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW

  Score

  3^/10

  discovery
  behavioral3behavioral4