Extracted

• • Target

    GPL-INQUIRY-HQ2426542.exe

  • Size

    1012KB

  • MD5

    b14fa28b7dd4f9722b088aa4512c2318

  • SHA1

    a2c9f494c0e353f4a3c86b49eb80e97fdc20d49e

  • SHA256

    369d01ab275e8b1543b142512eaef751d296990a308fcb6fe5018dc95383166a

  • SHA512

    43b8b323acb22adab157fcb8a73d043f8a0df22c521d85375f62babadeec04f7fa27e7704bae2632a75bce972b7433a43c50190713908c6490976ce29874bb08

  • SSDEEP

    24576:fAHnh+eWsN3skA4RV1Hom2KXFmIaImJvPE095:Ch+ZkldoPK1XaIe0e

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2