Extracted

• • Target

    DHL-OVERDUEACCOUNTLETTER-1300711528.exe

  • Size

    1.5MB

  • MD5

    bf80b724d8c53667f0c86c376584a7a2

  • SHA1

    ff46947c73556412915f71b3928e0787ea24ff1e

  • SHA256

    b6f69ae6add8fc4fe97fb795ba4fc968c0b57dcaabffdd5eda743f69ae5ab579

  • SHA512

    ee73d4cdf81b48c11f31804a9cee4d7c6462e4a64e9200d762554a933e738f4199c61bf7c4445e338b4614735a54e357385223f87a886ea2c4b5e9618564c4d6

  • SSDEEP

    24576:Bfg+Qnfa5DCGhPrdg3hNK8en6Oi9lPLzvPyJaHFWjrrnaLZ:N0fa5+EK3hNK82671zXyswmLZ

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2