Extracted

• • Target

    PO202501F.bat

  • Size

    1.0MB

  • MD5

    d6ed96a1b57736e3e0db5890ccd54f09

  • SHA1

    b3a1e550b98af6c1917b6edea2def0cc3eee0985

  • SHA256

    1682cc5be9fa4e376105cd2200e8b11afec236314cd692ac46d6ff1d7b64bada

  • SHA512

    13c414b76ba826263df42e4c09a5417d843d365b497e5b706e9e2b8b0892905b85970da73c911071a706ea3caecb5af8db4b6b2747eff046b90967d2bbafde74

  • SSDEEP

    12288:1aMaSzOKy2r7SPNcb4xUAXksJ1PANA+PSUGVPu4Ag2PDH/bCp:EMaSSKy2/SPNcc1XknA+PSUGZuVPDf

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2