Extracted

• • Target

    -5kOa04HngN_uuWp-JabSOnRD0m7_QIqK42a6ubjT3w.bin

  • Size

    195KB

  • MD5

    4fcf27b194d0997483c980ad25f1683d

  • SHA1

    e131dc4b02849d099b277c0af6fba06ac4d11c61

  • SHA256

    ff990e6b4e079e037ebae5a9fc969b48e9d10f49bbf9022a2b8d9aeae6e34f7c

  • SHA512

    78cb6bf0f768a42f8a403c2e0d624f6dcc9226ef67175b6ea1cbb56d405457d181a9959e4bead79cfc91392a5762c3cfd8d3f726e6202ac7ba6939e7ad5f4f1b

  • SSDEEP

    6144:xCvif6qyi8k+aL8P6MOMNzGuaqNdZ379ex+TueS:xkiA6GzG3v+69

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2