Extracted

• • Target

    DHLDOCINV191224.gz.exe

  • Size

    1.1MB

  • MD5

    49a44e1bd7ae31824843c4316f35eb35

  • SHA1

    29ca56d04c4d089d7aa30df2d3480988da425fc0

  • SHA256

    9ea5173104481c6538cb5fcdadc74682b3d422750039ab3311afe694e59b4602

  • SHA512

    c7e88ce41dd529f69d5a9aeb0d6a87fff85872215eb92815a67eb4b6533ff19a0e985572185b1ebda374635684ac8a1a7cde7737e780676ebb09f4d9aa98c600

  • SSDEEP

    24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aThZqa2nU5:STvC/MTQYxsWR7aTd2

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2