Extracted

• • Target

    R42pO9hQtYC159l.exe

  • Size

    743KB

  • MD5

    b3dd9590b35636f2580cfa18525669b2

  • SHA1

    4fa53976f2a330c71c40efbaa51ac391910c3b1e

  • SHA256

    77a0e4d0d77865d4261c9c73dc0da3e63a64755f605014d540c1f2b4b62c6bc0

  • SHA512

    ef651cca3d9afdfe0d091dddfcff3bfa320d4993ea4a93b6a9819a763fe1a89a41eb57570ea8f046cfe058f1a6f2bcd6981434cbf024cce190b32e03e9cef097

  • SSDEEP

    12288:Rjr0osPnfoWzylGZtMouH7SaeThSiwpCb6xj1N9tBVNgkZa3MBR8TUs9H0z:pR4QW+ALMKtThVwAqj1N6kZ34TUs9

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2