Extracted

• • Target

    New list item 830982373737379293873747273494987433PDF.scr

  • Size

    38KB

  • MD5

    ef0ee0495d7cdecbda4c194585446076

  • SHA1

    97e8397350c9e44a72ee441a72ec7f49ce9693bf

  • SHA256

    109c796b316470b61df7a49a0250af8562f130e6365c702ea5559926c1aeacfb

  • SHA512

    c8d955df0cb828139ed10202fca58372ac87bab73f621fb808622126dbd659eeda9867f893703d60d8921c92de6d88f5bb4df89a96ca83fe09168857d3aad0a4

  • SSDEEP

    768:QQ1fBiwnn4Z+8ApjDB6/q6g4gPdQOY2Jd6IrhLzqLV1KjUwRI9M4xM8hvmEjCMA5:QQ1fBiwnnC+npjNcy6VUd3pqLVAjxIox

  Score

  10^/10

  discoveryvipkeyloggerkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2