Extracted

• • Target

    F845A30719D06DE27D96857DC77A0BDE754405223F748606A1006C3C55910A90

  • Size

    1.2MB

  • MD5

    38c76f305ebfe964ff32f33857ece220

  • SHA1

    db16d0e4fd7e4472097541996e725e79f523429d

  • SHA256

    f845a30719d06de27d96857dc77a0bde754405223f748606a1006c3c55910a90

  • SHA512

    97ddb9081c9b69b45062f2ff1625c7f181a2116bdb901206fda83641b7b9b6df936da659c2cbae38516068f6caf91e69e8c1663f883b3e2ab019d5278da38447

  • SSDEEP

    24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aPh6ovJJuf:yTvC/MTQYxsWR7aPIoK

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2