Extracted

• • Target

    Remittance Advice2000255566644.exe

  • Size

    1.1MB

  • MD5

    d3382c7ece891478f530aa870b8dfe9c

  • SHA1

    dfc9a03d58c27797a6f22488ad4d92abc110c3ac

  • SHA256

    d7821ba940b6c2a56687df8e47d53420e222e6c4a1033ce6f9367b9cd6ef1756

  • SHA512

    ad37198368118b2fb87021095f03ebb3e37ff66f7b41dd982fdfc8d4a6d36fe3d2312edac0f3650d8bbe4a58831e6b3a1e7658bf2f7d139d23f1c751fa488629

  • SSDEEP

    24576:eAHnh+eWsN3skA4RV1Hom2KXFmIaDgx0dFrhIOdcG5:Jh+ZkldoPK1XaDNhIk

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2