Extracted

Extracted

• • Target

    5b370f3ac7f408eb4030e1b7e45142f57866e62bb150242174777ae3bb5bb0b0.exe

  • Size

    530KB

  • MD5

    3f94f93de7eee4883dee0bb194c618f9

  • SHA1

    4504b0f30c9c3c90f7e35a9fb4a351286dd32c76

  • SHA256

    5b370f3ac7f408eb4030e1b7e45142f57866e62bb150242174777ae3bb5bb0b0

  • SHA512

    d76b47af745364c1c9153bdd31429b853ba98a8be029d695a788f0881e7a64d179226f488a60fde0265cbc2fc95cd5b07b9415068f86eec2d13c5e82f36c5c19

  • SSDEEP

    12288:IquErHF6xC9D6DmR1J98w4oknqOOCyQf3jtcB8P4emNjbWd8:Jrl6kD68JmlotQfTtS+4b9bR

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2