Extracted

• • Target

    AWB#5305323204643.exe

  • Size

    1.8MB

  • MD5

    f4aafd3c1d6cd42208b22a1247c9173d

  • SHA1

    1fe9b387b96e6a6b2dc0736bea67a3a93b0357b6

  • SHA256

    fe82ebf70e17a486c040741c41f882d46bf2328986276bc4fcae991a2c126a18

  • SHA512

    746572fdd1dfed6465ffc065f1f3d5ade6d1f995af3fa16604872473023d657c587e26cde9fffbd5b000e0a7b0d7714a1e93bf3a86e79e2fcd1c586b3ec8df2a

  • SSDEEP

    49152:+19q39adgJW0w0s/2gzOkB8IaEAehfeeAi4jw0+EckLh0Y5Y:+19aJm/dOS8IXAehfSdwPVkLiL

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2