Extracted

• • Target

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe

  • Size

    1.1MB

  • MD5

    909a37e97faff915cd4906fe7684ec63

  • SHA1

    5ae37a8ae70e36e9cf4f9e8895045f77eca11c51

  • SHA256

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f

  • SHA512

    58bb45c2d55b4602852c0921f9aa39f3a09645689beea49b7408ce44da75eb9f9701effc765f3808e8d79eaefa9fc49531719e3d334d1d21e54ca35f78cac25d

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXFmIaQtS2rEDjuKsV5U5j5:2h+ZkldoPK1XaQtvEDqTV5UL

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2