Extracted

• • Target

    RFQSHEETSPX2MULE25SHENZHENLUCKY.exe

  • Size

    822KB

  • MD5

    02bc82a10c674c5c8f60d293e22a544e

  • SHA1

    7b6aecdc2468eb633ddec37397e55fc778c824c2

  • SHA256

    8b672671606f402445e1d10caf2f59a41e36ae4201d189ac202f5c7c0c66f3a4

  • SHA512

    db3d9771b2dff93f1117e5702be38808132519b656b87ae7fc99582882501911e2e8ff4ad23a70a63d7bfa7c55f3811d80eed42a835fa678b8e09f8e153a7d10

  • SSDEEP

    12288:QcGLc0gGcbsnxBGh6j0pSApXUFwK0g5MCao3AiqLwgDd7P//RIFLIs7Q:/iNgQ7YpdXgXgo3A9LZ7P/JIFLIs7Q

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2