Extracted

• • Target

    2D3F1929E451586F080AD57D0AB05D950CCE0E9F0DD6BFA6F9A79448F7FA909F

  • Size

    1.3MB

  • MD5

    f33282e91adea9f629dff3ffd74c013e

  • SHA1

    8ce37759d927ee6c15e60e47a362ea95eed6c232

  • SHA256

    2d3f1929e451586f080ad57d0ab05d950cce0e9f0dd6bfa6f9a79448f7fa909f

  • SHA512

    53d8bbba2eb7ee849611102a58a803f3f909930dae967b77e48ced56b914d83b286577832374622efddefb24b2b484d8c4c1a81b92d01f8d2d02b944395f351c

  • SSDEEP

    24576:sRmJkcoQricOIQxiZY1iaQZ/305ME/fDXF26TPK0PZOBt+BMl:5JZoQrbTFZY1iaQZ/305HfDsuK0hOBOG

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2