Extracted

Extracted

• • Target

    BugSplat64.dll

  • Size

    8.5MB

  • MD5

    1ff0255fb75d95d65da33e95cc93d871

  • SHA1

    5e59e19d377381faa9c842b3abc53cd1d15c6451

  • SHA256

    b28a3906a0ea16e8766f9c14ed934e1f689cf5b0d95c5463bd3e4de97873c046

  • SHA512

    b4c693f3499be2a7b38f68caf9241f7f3fe917b329e480420270e342c7a7d398747700ee33de05e08b52bc5ca3b4636ade3a01cc299006d01f0c4cb88a4ceaa4

  • SSDEEP

    98304:1gaqeCWnlBVJKsWZiV5wn6dMPdXPE7m2PPf1Gf6:iaqeznl/wsWZiVG6I2NGf

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    PO202501B.exe

  • Size

    255KB

  • MD5

    2a39ab7049226dec986fa602a26f5372

  • SHA1

    f0baf3b4f1dbcc6dd21e6f1279c741c0051c03cc

  • SHA256

    ad4cd780bd7accd7482dcf6222910aafee971c7ab870ebae0022d51b237fa5cb

  • SHA512

    5190d06d07b72f8ebaf326b6c0fcd85963afe598be499afee11881905ded944b58829a6ddc85a94f75621e5936496e151a1d8b4b96d12d38148a1f256841dafa

  • SSDEEP

    6144:WIaCAK/UGjgTPD/CRe4GvTS8w9hzc9ap+zGj:hz7KmH9tp1

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    vcruntime140.dll

  • Size

    84KB

  • MD5

    3e746699828f9e9aab45b8f1c3cea4a1

  • SHA1

    5ba84f26e47670c865e21e3303a28e54608475d3

  • SHA256

    de6ca787d0e0a30810fea570db867199d32ed71867e1c36a0f58ed71d540f035

  • SHA512

    ecc2c06a96661f063bbce91c5a7239e24aae3a5924ebb8773cef3d9e1d332959612bd052991ace98700d25912266ee39ee93ab623befd20f548d62f451426218

  • SSDEEP

    1536:ca0fOoqCbITyAAAmYIihE7Ka8maPKMOB0Fc2/ecbQ7qdWdi/phl:cnTbuyAzhphgLcBOGFxecbQ7qSi/t

  Score

  1^/10
  behavioral5behavioral6

• • Target

    vcruntime140_1.dll

  • Size

    35KB

  • MD5

    f124d735ebff3330b5b6cfa7df1c17be

  • SHA1

    ad9cba122a47a4be8c3ec3ac6ce2d920f7e40baa

  • SHA256

    d34288fcb286d4e2056f969767a65f09cf6e71ad27fe3af4edd1584cd95fd55f

  • SHA512

    e5f1fd40b28861f3f7e5851e47b60a3035216129e0491f112e8ebc4dacd4c890a06caead8aa7d4ae7b64bd2b0c08e1ba17bad924534fcedec406895ca8af8c09

  • SSDEEP

    384:lbPvL6j8qS3RZ0IQ8tq7+B5Wjfy4hGCrNWrSVbWENXfGj5y85xIam4WrNNW7QHRV:BvGj8qSBoEiy4hvCsjNveIamvW8JuW

  Score

  1^/10
  behavioral7behavioral8

• • Target

    vcruntime211.dll

  • Size

    302KB

  • MD5

    97be015420c6c91a5efce20cd8e24870

  • SHA1

    98c536452c02531d391d6aceb738df1075e9436c

  • SHA256

    7c71818ac259d74e5364833d826756760d872050d286fa8d292fe0ff667d7470

  • SHA512

    a8023b97b208fd1518f47cbb353d9a3c35654e326d316ebe334909092413290304f1a06a5d7c47b2be4af904db6a54fcfc758deaa4624a770d24de5252fcc0ec

  • SSDEEP

    6144:y8JlLPzu+F8hYh4Q/OVbvc/G9TvHINHfgav4tG5vTqx9qE4XuyXDWMAXS9x:3FPzu+RhWrc/G9TAgav4tG9Y9q/FDAMx

  Score

  1^/10
  behavioral10behavioral9