Extracted

• • Target

    (Factura de crédito PCJ 26265).exe

  • Size

    7KB

  • MD5

    1e70f026b0c331569a4185d5705a3847

  • SHA1

    3c4a903edea4bc5573b3bb5ef1436947b0c52458

  • SHA256

    64addaaf98a7661110412b386b41251e01b5baabb8b693c25e5d8e8a8adcdf88

  • SHA512

    c8411be7dac2fada1424cbd26df2c360db8efcd0e9862f91403ad7b5e472ff5de23170456f347c1435e05eac7ae6d9981e38c45ebfaebe54a137212719126bd6

  • SSDEEP

    96:wB1Auf28Id5I5ujAl4BWLyLDDtTjYzy2jMj+NlF7+PczNt:E1AupIPI5uj7WLyH9Yzy2Yj+fF7Om

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2