Extracted

• • Target

    Transferencia4317370002017852.exe

  • Size

    553KB

  • MD5

    99e39c4f2f22df9a099e7fc6b374dcf4

  • SHA1

    be78ffa0116195b071a9b627f8758b05c9e1233c

  • SHA256

    65923434a772e80f32b56fbddf49f5ceef3f536611c7a3f7c610c231ba59d27f

  • SHA512

    85c8c70e40855ce42358c13cfead8700c0f1b269661b7164081b2ccf6c2f47a09bda94bcb9e71efab49616b4c2607b62d7d019ee7c59ef8fe707525234ceac43

  • SSDEEP

    12288:v93jlfVEb2p27gyIV9h5cKVLK1Svks2Fjz4hzaVtIXPLcD:v93jl9XAgyID3xL2SvJajzizTcD

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    6KB

  • MD5

    b648c78981c02c434d6a04d4422a6198

  • SHA1

    74d99eed1eae76c7f43454c01cdb7030e5772fc2

  • SHA256

    3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

  • SHA512

    219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

  • SSDEEP

    96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE

  Score

  3^/10

  discovery
  behavioral3behavioral4