Extracted

• • Target

    dhl.exe

  • Size

    1.2MB

  • MD5

    c05369e8d3a9d0853cf1887e4b2b65f1

  • SHA1

    d74e46312223d257ca523779e8455bab8e79beaa

  • SHA256

    18d2d9bfd576ced57fbba554b2a0235d33a947a509559439b18f92febf8afa88

  • SHA512

    1d616a2977d50f5426e08736aa14e5c37bb6e919c19aced2b02d87812c59d73749aa2d0de6d9745166e79f45e983af7beca545e18df65b816433d1249651729c

  • SSDEEP

    24576:IOBHs308uOOKdZiT062Nc6aWrzAk2LIP4ylsjM3NVzyYTjMz9:hMPOCZ56MNf4k2o4RjMXDTjMZ

  Score

  10^/10

  guloadervipkeyloggerdiscoverydownloaderkeyloggerstealeradwarecollectionpersistenceprivilege_escalationspyware

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    cf85183b87314359488b850f9e97a698

  • SHA1

    6b6c790037eec7ebea4d05590359cb4473f19aea

  • SHA256

    3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

  • SHA512

    fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

  • SSDEEP

    96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug

  Score

  8^/10

  discovery

  • Downloads MZ/PE file

  behavioral3behavioral4