Extracted

• • Target

    DHL Shipment Document.exe

  • Size

    1.1MB

  • MD5

    23e373545c4c654d51a8d1fcca73a033

  • SHA1

    977d8c84d75ed100f39a58f5c46e2aa601359840

  • SHA256

    a862d0496b231553fdb9e46917c6d7af7f805d3159d2b1b248250fa1c540f009

  • SHA512

    34b515eb2138a86c5e6e3ef4c46d10e6c324521719725a4f67190d6224ac787fe183455197b8b117a3f0027c531f28b3a1605a5bcd68b11eaa129e7d76172813

  • SSDEEP

    24576:0Sm7qA/553rY7iDJ5jv36gaEWl1ozDKfkrfo61o8:/AR53rYeDJ5T36SWAckpr

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2