Extracted

• • Target

    malw.exe

  • Size

    1.5MB

  • MD5

    6cc9328af63e4f3c0e0df6a067ab8758

  • SHA1

    5f5ce53eeecc8a3d34bc99e4c432b9ef6eddc552

  • SHA256

    fe8f1302f9a091585f72592bfeae5afd523ff2848b4f5cecd12f6f2e69259327

  • SHA512

    bfe781368ccdff951862238f73f2f25d8fe6cda3214d193b75d7c330fec8010af52a440e13b7fa4f03009e69947081d6aea755b89614b5182b8a9b5fbce55b3c

  • SSDEEP

    24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aZjDVOcOvfIXIXiAWViOgC/Zxh:kTvC/MTQYxsWR7aZFYvfIYXiTXgkx

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2