Extracted

• • Target

    Hesaphareketi-01.exe

  • Size

    1.5MB

  • MD5

    43de2dc5c0b398ca27e3bba902dec724

  • SHA1

    2487b5d83c07914f862f11ff69ade1724ca582fc

  • SHA256

    c37e0728bda2493c19b2271f52337d112da79e81c06f8d1ab4b756063bccc219

  • SHA512

    a463e8f842176b4ceaaf4422ee11a21d522a4d261d9dbf3737facee63af7df429dafd3fafa3010b6ab8b172a2c09a5c9586e40a09c71c46390e91f4d2c67013b

  • SSDEEP

    24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8an1bF9C9ut8bmwrpWEM/PODD/HTNnC:tTvC/MTQYxsWR7an1bF9C948bmYAEM/O

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2