Extracted

Extracted

• • Target

    NewPO127429.exe

  • Size

    522KB

  • MD5

    d30b1c7244ad844dab07ba6116385ce5

  • SHA1

    e72b8f67a33b9acb2c52c8feb1bc3f61e801054e

  • SHA256

    063da58edb72802cf74c1c113fe4107ede937b346b066356158d38724d13c1c8

  • SHA512

    c874f5ea5d6c6081e11ebe98a8670bf37b34e8e11fa715ab99c7a3339ccd21731d65860696c04c81e078f6508cd722222c6d51a1d4ed883857837347183ba5a9

  • SSDEEP

    12288:5quErHF6xC9D6DmR1J98w4oknqOOCyQfFRZWzsSnBFxNrn6IZjX:Mrl6kD68JmlotQfFyVnBFxNr6IZL

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2