Extracted

• • Target

    Shipping doc.exe

  • Size

    1.7MB

  • MD5

    03abd0cca28167fb96a1808687c515c6

  • SHA1

    67654d6d764c5cf81295e358fb46d28653625ee3

  • SHA256

    b6020fd60ba9ad27209b47f66f4bf758d9213ea548cde4df5b4286bce2ed6511

  • SHA512

    19bfd8e1eb1c8a110f0efc1ef515e4b86ad774e6bc873984d1e97eef040786055cb6b4ec948dfa50f09dee462f7d4f405848e2b4ffa1b0d8abb91996a7368c7d

  • SSDEEP

    24576:yeAZV1fWs8IiwTqN/vXatODhIf9yqt0xkAXTFHut+b7IOIPM8tJeiGDsNbSTPtEU:yryqotk9yqt0b5HHHIfhJedsoTy

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2