Extracted

• • Target

    RFQ11102025.exe

  • Size

    829KB

  • MD5

    4e8dd0271e73e9132a34527f24d48b4b

  • SHA1

    eb063c7c3a0b50a29c87cc1eb679784c663a712c

  • SHA256

    342a6c5178eacedd99cd66da3bd81e767d0aa311441ad2089b087def3f5cb088

  • SHA512

    8eefc1a61bf8109bb306c70defffad8ed86eadd5956d1b73fbf6f1e64dc54cbc95876ae487cbd768efa7f1984a7955cea5e7051ef344e0d42851e91eceb557c2

  • SSDEEP

    24576:GPlSRYjYIyAT/+BtjkzFtM8HLggynnN4:GPYRBIhTmBRkzHLggynN

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerstealercollectionspyware

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2