Extracted

• • Target

    PaymentAdvice18678.00.exe

  • Size

    1.8MB

  • MD5

    5c9f652fa757862394cd5993283b34b3

  • SHA1

    85bdf093144fb2e6f1f4c8c5c9d6bf50b5523e28

  • SHA256

    657791b7f748b9280b72ae9be5b6d2f4eff25a83379dcb454722ebb5fb866199

  • SHA512

    a1ee2c87d829f81371d1ab1a6f978a3b0f447e427145e3eab5bcc7398f8a9c80b4eeaabcf332e73fc96fa93f3ee70b1bc4b38614a27b9ccb0e912ec26ad0ad7a

  • SSDEEP

    24576:gUQ1B3qSBzLXPVXH+H+xKvas3lkVZbEjXebU6m/b:gUARnXJHb4a2kHbmebQz

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2