Extracted

• • Target

    rDOC-202501.exe

  • Size

    1.0MB

  • MD5

    cd5bc095d295da05986a022c609d759b

  • SHA1

    6d3df383590728cbe30802e92cdfaba83cbf7b0e

  • SHA256

    a45596db810e56d8ba49f6331c07e63d724795859bc1763323df551bfa7d7c52

  • SHA512

    2b7ec01c7a870d2d5d876a9d09ae3205c0ac3061cfd3470e3d33e1aebfc8e5bf9d5a5cde97ceb022aedc5f4d8a973583c2a6e58325427364cb15f63a981550ab

  • SSDEEP

    24576:ju6J33O0c+JY5UZ+XC0kGso6FaL2/Cb+QI3/ipg6WY:tu0c++OCvkGs9FaLKOIY

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2