Extracted

Extracted

• • Target

    SWIFT ADVICE - TT BANK PROOF.exe

  • Size

    742KB

  • MD5

    2bd7d2a629433ed5590d573705695674

  • SHA1

    03c3cf93ece17a5430b68ad280f5a428dd525a21

  • SHA256

    2a797334390041e452211a8b208ed46fed6142f6bec51585f2f42c7197b33899

  • SHA512

    ec8a2e1d4da08186af17a0c3a41259bdd9853c0b2480a4dc99595d78728040da25b5f3ac72d5edc8610afdefb2e892404549a0b6946465c1219793744ce6cb79

  • SSDEEP

    12288:uPYRxA4Y5lyA/BxSPChU3IpFro4s+R2SFlVKWdMi9PSU3Tj3jlDIsM3SCCIdwPJR:fRU0Ip86leWLjztDM3raPnlT5

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2