Extracted

• • Target

    6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe

  • Size

    635KB

  • MD5

    9eeaa6c9ce625021ac21b5eb40fb73e7

  • SHA1

    459fa22834028579136aebd1327a6ff8b6e654cb

  • SHA256

    6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739

  • SHA512

    202fa2b529565bdf1e2691a12f3b91d5bc6303b5d926852048ed482a071491e8ecf98cc8be5fd1be743a82400db6a57f3ea4cbfd1eeb0586dcd508ba76b4dc50

  • SSDEEP

    12288:lSDeMUQg8x4aKKnpDNsLXfzYoWg4IcQ9y3zf5ju9sis:SeMUQgUlNsvYoWdZtjBu/s

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2