Extracted

• • Target

    SHIPPING DOC & PACKING LIST.exe

  • Size

    1.0MB

  • MD5

    e263fc8765adb06ed960b72eeb9f28fe

  • SHA1

    c626d2a01be9e6b604cfb8b2bcfe726b197d669f

  • SHA256

    b128de41d4110a0035114b6372967efe9ada4e603b7405b1d14f6b1102ff49c7

  • SHA512

    eaa047a62f9897e50f1d5b4dadf9fc8ddbb153402957dd6cc470c89fc18ccb9a3e3a93b0a3b92afe243e2b1dc2225cd98d82cbc4cfa9bd5f4003a24ec596146a

  • SSDEEP

    24576:/RidS/zXyEbNJ+Z70sAbKK0N3FppnPp48:/RzrXLbNJQYVWH5lne8

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2