Extracted

Extracted

• • Target

    HAFEEZ CHEM GROUP CO.LTD.exe

  • Size

    1.0MB

  • MD5

    065898099311d94907e242c9f4a59935

  • SHA1

    f1657569ac07a17a47ce75e9c2ce412ae4531719

  • SHA256

    e824bf026bb0d12fbea0ab8fee5987455d7e4d330a89bb2c477372a84268f29c

  • SHA512

    c4afce88a8bc0c47830b384d83591f5a3c82f608e068f12507654e4c49692a3911ab8e4c56ad4be678c04224298c3cec9b4ef9e7c1f7268994df44c932c01d1f

  • SSDEEP

    24576:oAHnh+eWsN3skA4RV1Hom2KXFmIaLwLPExgFR4G5:vh+ZkldoPK1XaLw5FX

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2