Extracted

• • Target

    cb759a16bd2daead770a4aa60357ad804d5d4733554c0d41adafd1920683a0c3.exe

  • Size

    2.8MB

  • MD5

    3a93681cf2ff8a1565e2d7e4a5c36d69

  • SHA1

    8c38b1ef5f9c5c70854108c1f50825c8533a3646

  • SHA256

    cb759a16bd2daead770a4aa60357ad804d5d4733554c0d41adafd1920683a0c3

  • SHA512

    9d1a49799d74424824fedf4196b1cee62717e191a407a079d97a604370473ea29d52cf6bb8a29d67df868209678a29f42b9fe7dc42abd3821cc2a2344c51aa91

  • SSDEEP

    49152:mF5tpzf9m3wrHeH3W+jQXDEjPbHxizzKuSSL6fhpixs0LrTrNUon:DQHCmgCUPNSTsDcLvruon

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2