Extracted

Extracted

• • Target

    Inv#9500009424.exe

  • Size

    532KB

  • MD5

    13628c79c5c1febc28bc57bf7ec89272

  • SHA1

    e568d6984413658351e5be9f121ccdc66e46b71f

  • SHA256

    7e1ad38a28e90dd0d9c52003b47929b83c99ea43560e9dca9db8cfdd167788d3

  • SHA512

    8ed53c692e6634ed56fd6e80c6854026c178707cb6d48319c2f8e56cefc6cbe198ccc3de8ca467f1578d440c84ec129ac49199fd81bc5535234a56ea9d0daab4

  • SSDEEP

    12288:vYV6MorX7qzuC3QHO9FQVHPF51jgcoe7DAerHfq8VQv:8BXu9HGaVHoeDieQv

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2