Extracted

• • Target

    DHL-OVERDUEACCOUNTLETTER-1300711528.exe

  • Size

    1.3MB

  • MD5

    e4be85fd39b06077ad62ee5411e529fa

  • SHA1

    072f4e4446357094c89bc75ee24bb41392fb6efa

  • SHA256

    91cbaf0eafd7e647fe5e9d6524d0190d1e62ef168bbe6aac0e6ea017c6aa55bb

  • SHA512

    b3d89154326f31624ed2cd7fcfcad827bbbec04d7c58767914ca958fd97c7d8bba643633d563f28676c64d0334059646e71d00510128757f96333dbcdefc5672

  • SSDEEP

    24576:ySCF6rZw5Ac1MnnEZ7tEmkgqLxF15g4iWfdFeBzIAx96NsHL:dCotw5Ac1B7tE5BLxLy4xreBisHL

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2