Extracted

• • Target

    PDF-3093900299039pdf.exe

  • Size

    1019KB

  • MD5

    1f74495f02ad58ff437b07cf58a3e0ad

  • SHA1

    9efd59d289256116e9f539ffd7cc319603ac03ba

  • SHA256

    cd7aa2bca4b3612823b7e73160896e886a3e3ddd495c3ae7f2b47868c5dff0cf

  • SHA512

    14075253cc9e49a6dc9af8544f82db2bb4dfa814390739e6bc5d0d8f6ca74dbf6e989585977f968a1905f4d7c55220c11617886f6dc29a4fcece97b608feeecd

  • SSDEEP

    24576:rMaSSKy2/SPNichdpPEcw88Cco4H4444C:rRQrc5PEcwi4H4444C

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2