Extracted

Extracted

• • Target

    Inquiry- HQ242654.exe

  • Size

    879KB

  • MD5

    21f2a8fcfb4784741a505b3a71a3cb4a

  • SHA1

    5d82ba99ccb989c76675b586bc5629ff8b2bc138

  • SHA256

    ab158b7e9b371e301d2554b7eb3f6363cdc88efc65397343d3ef179db7e0d68a

  • SHA512

    7fd89af9b3f20a1982a60dbd74e484b404cc5003fdc351951320f47443b168e671d73699243a060917c0fca811b61a05e88cb92367883523ac1440103dd7f244

  • SSDEEP

    24576:tthEVaPqLWxWdbFLK6hH3gbqW2NBefa4Ts:VEVUcuTIguWut/

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2