Extracted

• • Target

    312A749C4528552FF811115226523572DD1AC1438AD0BC2ECBEC537F1F05DC69

  • Size

    1.2MB

  • MD5

    bf0a9975ae5fd914d20c4a3faa319247

  • SHA1

    b1fcdb594b8e37dde0bf74669fd023721a91fef7

  • SHA256

    312a749c4528552ff811115226523572dd1ac1438ad0bc2ecbec537f1f05dc69

  • SHA512

    af78306ab0b701ca086288feda31cf2e152f31d70b509aa71b528881c215d6c68c426966ef011155705a22bc20d30b95fe0ecb1fa58ad82986dc287f6253d4a6

  • SSDEEP

    24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8asU9gyB/MX0Hwdi6:jTvC/MTQYxsWR7asU9/BUkHx

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2