Extracted

• • Target

    640b9f47f147b0d38fbcacb6aa057f67a32f8aa3fa4dfc45a83ef439319317a6.exe

  • Size

    1.1MB

  • MD5

    7e01f412c2520b42e189f327f0b9fb89

  • SHA1

    895317fb7c2939ee5dd0a6dd9dcb745dcf908ffa

  • SHA256

    640b9f47f147b0d38fbcacb6aa057f67a32f8aa3fa4dfc45a83ef439319317a6

  • SHA512

    eb0d2b0702e84497ce411118e7ed69309cccd9f06d9b63fc0e40b8abef8084d32522d21adeaced6e02f62c6e884e8a5dcccf22773e0fcb92d928895484d475c5

  • SSDEEP

    24576:Au6J33O0c+JY5UZ+XC0kGso6Fau8sSB6l+aJWY:qu0c++OCvkGs9FauPS2+3Y

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2