Extracted

Extracted

• • Target

    invoice for payment request.exe

  • Size

    528KB

  • MD5

    42c6243d19bed300a01fda64e3d16819

  • SHA1

    5dd4196945171a9c4a0d9b8f65070a1289d2a288

  • SHA256

    1a8dd4fa9763e441591d8d927e8f69dc9e5138c62c80c9ff8d5007a1b8b2bef0

  • SHA512

    0551531fb48a0e7097a7a38233c8bf62f6308519912538fd1774e7dd2c07d198c1d7912241749fcb543048a3aa89347911d92db264d74d0c933567617841ce8c

  • SSDEEP

    12288:OquErHF6xC9D6DmR1J98w4oknqOOCyQf66zHERlIf7TcXHN87p7:Drl6kD68JmlotQf6akRlyTcXHq97

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2