Extracted

• • Target

    SecuriteInfo.com.Win32.InjectorX-gen.30619.30529

  • Size

    685KB

  • MD5

    0a0008306f1bf0a3f73fadfe76073ad1

  • SHA1

    4908877d52abb1dad59f135ad6506aa4853f9cba

  • SHA256

    043786bcfdcc39ba1659c78de1bfca2b9a77e47c8af326a48d4fc33b92347ecf

  • SHA512

    1557faea21ac4e11abf224e5baec15b54e56cf40a4809e3d1ce7ccd76f7b0ed89acdc0ce7822dfcc83f4f75ec96dab169a0eb2d9f2788dd01ff403bc0e83de28

  • SSDEEP

    12288:Az3cQH2j6y/vSO4YMh657ulQgdqduvjcEYvgj47T7m8jN1V38Cgx8Fs0/L+/lubq:McNj6hIMh65Cokp8f7djNvs7q/L+dubq

  Score

  10^/10

  guloadervipkeyloggerdiscoverydownloaderkeyloggerstealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    17ed1c86bd67e78ade4712be48a7d2bd

  • SHA1

    1cc9fe86d6d6030b4dae45ecddce5907991c01a0

  • SHA256

    bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

  • SHA512

    0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

  • SSDEEP

    192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+

  Score

  3^/10

  discovery
  behavioral3behavioral4