Extracted

• • Target
    FACT0987789000900.exe
  • Size 626KB
  • SHA256 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd
  • MD5 e4da22458c317595e4bd6712b4728d36
  • SHA1 111a5c4cbd45bced7c04cbeb5192a9afe178865c
  • SHA512 b19d9eb5e06834538e8ca5e8655e360b56d63c8ad67441607279c18a848d46a6095b6cbe7019fc79eba784392278e30134e7aef149d0e12964d0b86ecd08dc1d
  • SSDEEP 12288:ROv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPifIl4AbNfoQ+MvFE7v44OzNRlwDmt:Rq5TfcdHj4fmbMo3Jhuv44O5fwY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2