Extracted

• • Target

    b87da989bc58c277f819b39884a1a5097c6e55cc522cd482f1db530f10c38ed2.exe

  • Size

    1.1MB

  • MD5

    aa973d9cb06a851f47ae5085b61a4c24

  • SHA1

    f7999950cdf6242524eb37719666fe4848b0ff9f

  • SHA256

    b87da989bc58c277f819b39884a1a5097c6e55cc522cd482f1db530f10c38ed2

  • SHA512

    b804fb32c557dfb64df9231a3dcf4810ccf503f86131c09af8f5f96ec86b7cbabe258c5a4f3d94a0a8a684eccc28f9ee32114e388bd2c3b2fefb0ce65eb42980

  • SSDEEP

    24576:huaHUI5+zim0CY8iMo6btoLmUo9fpm7xCyjRI5I4HvrRIv36Urpg:saHUI5+g8iMJOLNozm7gyjR4IGrRe3nr

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Downloads MZ/PE file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2