Extracted

• • Target

    cf28af37882fea56145883bee9a128cb31b51c07d449b49e3071499b5f6f70ea.exe

  • Size

    898KB

  • MD5

    d206d2d4cc4961ace139ac7eb8c4f305

  • SHA1

    72555790ce99624754007f0de9f8757fa4c4f488

  • SHA256

    cf28af37882fea56145883bee9a128cb31b51c07d449b49e3071499b5f6f70ea

  • SHA512

    599da72384d2799fa6d33f3dddd621373af0cbe956f99b811c42d6be1dfe16be4bb4c183640b40384b9aabae4f793ba4fd6d1f46c6ef22c24db4d91baad960f1

  • SSDEEP

    24576:IX22+VsNxAe/3jvPyC2LqE3l8Et2F2Yuri:a2exAOyTv3uEtUW

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2