Extracted

Extracted

• • Target

    OUTSTANDING PAYMENT REQUEST.exe

  • Size

    1.2MB

  • MD5

    78969cbcca783c376160309a00ec4e2a

  • SHA1

    851b49ba65b73f98b8ca4d308589d6023817d3a9

  • SHA256

    df43f86a6dd300e47ac8d57aeb24bb4037165fcbff954d91379773474e2481f2

  • SHA512

    7d0892a5b1967b4c89e3a8a42060b23e63d72dd076a26ffb6944e803fa1fb8373edc4bb589abc64eb8201dbfad07e12abb65e99ec6b270e265de62be504dff02

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCmE+yhEDXCUna4Ja0lkZQ/42NB:7JZoQrbTFZY1iaCmlfyUnVJa0la2P

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2