Extracted

Extracted

• • Target

    Invoice No 1122207 pdf.exe

  • Size

    1.5MB

  • MD5

    f4d3b326b29b4d0d8269499be0bc6b7f

  • SHA1

    f64f81909454b15dba91e95d5da9d7684cfc59f1

  • SHA256

    c3290e5cf7ebc77727f778129c3e235bbb23bdf2cc6136e4a442e7034da7abe5

  • SHA512

    553cf511061e2862e8218ec0ff8a34c9cf5efafe7b7c4ba3b07a0c105d5e238a17e697a5582b7d825cf065566b26666f48a2dcd59096fc64c5cf40eb90cea50b

  • SSDEEP

    49152:0TvC/MTQYxsWR7a98rj1xQdK6xKXbo7Q:UjTQYxsWR/MnKXmQ

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2