Extracted

• • Target

    URGENT DHL - OVERDUE ACCOUNT LETTER- 1300711528.exe

  • Size

    2.8MB

  • MD5

    6c3f550d614e789df671f547b8bf60ca

  • SHA1

    cb70756917bcd865bbb441ab75c00a1e3dcf23c2

  • SHA256

    34c06c3e40d9b454a9b8cad1b0a52ad8f1974f63f4badb9613ea07ef426ca3b8

  • SHA512

    9d19f5e0ced8d783f5fa58f482ce643cfc32c15a6b9335e85799ca556be42a667d19bd7d337ffacffbe0ec3d55ba3ffee1c5b53a7769cdb0cee4025812adac9d

  • SSDEEP

    49152:0VgeOuaAtbjRnSEAdt8S9DLNIs5TvFekcnG/6L3GTrb7RZotJYG:0paUHRnSpt19PNIs5TNWHL3svXaJV

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2