Extracted

• • Target

    Ordendecompra2073837734514245446line1490.xlsx.exe

  • Size

    1.1MB

  • MD5

    0504db08c76a38dec08e4f6b2a155cf1

  • SHA1

    a0f6fe508e54bc8d6c5d5402f04d35cb27975021

  • SHA256

    1a8ffdb70591463b95ad437130b052124f5e6f61ac0b643058dc91a827a2a189

  • SHA512

    35a5375389c5f5591e8b12b62e73a550eeb57995c738eae586b9df23e0504e940c2fa17143319a5d556adc3f4ffa0ac3fa65e47798d75a5898f0dce2f186e699

  • SSDEEP

    24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8amh8N:sTvC/MTQYxsWR7am

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2