Extracted

• • Target

    b9b72b305909d1d2311e044b49181ef5411d5247d5674fc9cdccc3b7ed7c0421.exe

  • Size

    843KB

  • MD5

    4e523395a445b905402cfcd5728a4a5c

  • SHA1

    f3b7b24df9ab234a6b68ea97ca1566210ba490ef

  • SHA256

    b9b72b305909d1d2311e044b49181ef5411d5247d5674fc9cdccc3b7ed7c0421

  • SHA512

    23523171b883c3e1d2208dee1c6f9551311c4b4c95783152a40162254b4fa06060bb8a18b72041ea0ac72866360c72f63b541840b035bbe0fc3d7c79ef1a05bd

  • SSDEEP

    12288:bkuXIHHuuov4KfGW5RASJ4PzcSsgUYvfrAYZvKek:7XIHHuuoVfGW5/e7cSsevfU4C

  Score

  10^/10

  discoveryexecutionvipkeyloggerkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    Universitetsstuderende.Tor

  • Size

    53KB

  • MD5

    e4c90f84532e87a7be49136c6dedd496

  • SHA1

    3318b1654e28bb021204b89ed0074125ae449a8d

  • SHA256

    6313d40ac7f5dd82e268ccb8ecc0239f85d0e42fb7a484c6f6f94e644a6e36d7

  • SHA512

    3ab67b0b7f0a6f2d721e18bc6a962512dd7f58be6ef77602fa8508b357871f26f71a22cca7775132758e7774aab2473dc991cde17b62fedfe2c3c928a0db169e

  • SSDEEP

    1536:Lflo6h6Sdinsr7/AVs2yG0SGrIbmsynCDD:zlo6/f3Etyi3xD

  Score

  8^/10

  executiondiscoverypersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4