Extracted

Extracted

• • Target

    QUOTATION REQUIRED_Enatel s.r.l..exe

  • Size

    1.5MB

  • MD5

    f8410bcd14256d6d355d7076a78c074f

  • SHA1

    7ff600a40521fb8267fd305f601832785f975d40

  • SHA256

    7e9b9833268dae6e33c83b582ec7fb353f0dc6514f869e3228f0effa161da00f

  • SHA512

    9e32b73669491bb42074018c52ffaecc415e9f24dc4fcfcd346da8e8665e89f27c2caaad777294ead64668f1e264d27d4797f28a5a1b5e58937cdefe45b63019

  • SSDEEP

    24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8an1jKpXvJZEWWNbD39MLJO2QfqVbW9:aTvC/MTQYxsWR7anGJqDuLxrVbW

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2