Extracted

Extracted

• • Target

    payment reciept.exe

  • Size

    969KB

  • MD5

    98e60b3ecb07393604513032ff9cece8

  • SHA1

    39b4a69001bb456d3134601167b031ef516c4b63

  • SHA256

    c41935933af8366f81832e9c6239a205a1cf95c72ead834feeb1c3a2f262c8f5

  • SHA512

    b01c40902034e650f9ad7bbb0864a9d95147bab760865623147eb0904117afa0c3c857f4fb7803d2afe3f9abd8029bce835d81d5d204f3aadd3e969fb9371945

  • SSDEEP

    24576:Bu6J33O0c+JY5UZ+XC0kGso6FaMoSYUDFX8WY:Tu0c++OCvkGs9FaMogFvY

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2