Extracted

• • Target

    4396623a16b786eb06a8ffde747c3399254d0d6977e5eeaef4fcef38e1615846.exe

  • Size

    1.2MB

  • MD5

    6233e664c66da2bc8236e395d69d5e99

  • SHA1

    dde0a2a9112e071a45640c03d51d74c97adacf65

  • SHA256

    4396623a16b786eb06a8ffde747c3399254d0d6977e5eeaef4fcef38e1615846

  • SHA512

    ea2b74c59cda11a1ebb9a1a4b5c99091f26a7c9c91bc7becff67bc6f628d4a80637de19ed22ee48da1e1e25e0bd3de268a1420dfdf144939f60b7e6b1cf7a04f

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCpN1W+toAuoT5g/DFiwzRw+Zt:7JZoQrbTFZY1iaCzgxJoT5KFivKt

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2