Extracted

• • Target

    Ems_inquiry_catalogues.exe

  • Size

    1.7MB

  • MD5

    3018e9591f54c3dc959ac9834995b9b6

  • SHA1

    a50b74eb202a1c55362d6b7931fe56b7c0bb4312

  • SHA256

    0baecb92b8e375afe7db841b521040f731c923e5919fc23f42be91973366a83c

  • SHA512

    7a0cfb1d0f6bef45c759de73ec9fcb0b8c2ae17fedcacb0e201f8925dd79299bded7c62a360e0fc1f2b44073461576876076302b73cadfc7bc5a4659cbc906c2

  • SSDEEP

    24576:ELFZHUCS4BarJd8clGjBJpWLqrc3m5P+v3Ej1ZiCn7HGEah8n0WzxUmLTPZCK5Oz:EhSzJdLsjrpWEmKk3E1ZNDGE3nrzpTop

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2