Extracted

• • Target

    QUOTE-BL-P.89O995pdf.exe

  • Size

    993KB

  • MD5

    cee416c06c1d15f65b3774b222c02286

  • SHA1

    757b458be33e42a3f41b95fa848a97f1039941dd

  • SHA256

    af8878eb8a759d1aff4b2fa4747fbf420f138f7b0fb6fd6182140a96c6eafe1f

  • SHA512

    df2133b5d300fe243241a6ed19bf025045759df55a5395e2693667cd59174c2e2147dd3ff090682f0cd41112b50fe208930400bf3e49113605745917e7dbf575

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXFmIaIovzLqQMOvL+5:Hh+ZkldoPK1XaIo3dQ

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2