Extracted

• • Target

    Comprobante de pago__pdf.exe

  • Size

    19KB

  • MD5

    4dcee6e4f297d24fad9454f56d9ee269

  • SHA1

    dbf96d22cdfec813decbac5d54c07f3f20f543c8

  • SHA256

    9aeacaff1f4ad8fa2b5c74318e05fce3827b3ab5cf7f54e286b43af5208c7140

  • SHA512

    00c1794c2cd389d5300f220915999945cb76f50f401ed85594096c328e9fa95460520dc856bfdd064cc200878cc00c0470bf59789fda3bc7af835ded300ecd0b

  • SSDEEP

    384:054nPRWVb6+m9M6qYuJY7te5ixNQfQxk1CxCvwN8:3JX+n6G/jDXvwN8

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2