Extracted

Extracted

• • Target

    Original Shipping Docs.exe

  • Size

    520KB

  • MD5

    fa95d941bc3b0a98262652b13b7a3290

  • SHA1

    5d09e1eec6ffdc8bc8669d18f6f655b53cb9402e

  • SHA256

    2bedd3f965d463529bb4096342c1741a19f28cbf7f2f222d2cb6513ddfe109bf

  • SHA512

    20ec5b835e191104735897ace988978f0d36486fe7f98f6171fe4b537515250bd61897ae80029fe28c100bcc81d0e1cf78f52899de83f461f4e88d07329ca9de

  • SSDEEP

    12288:NYV6MorX7qzuC3QHO9FQVHPF51jgc4ui42BiElpCOHg0/EWJ:iBXu9HGaVHXxVElpbgLWJ

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2