Extracted

• • Target

    DHL-NINGBOOVERDUEINVOICES-FINALREMINDER-456034158.exe

  • Size

    1.5MB

  • MD5

    d43e31901ef0a941476b20b1dbeda070

  • SHA1

    80aea35990d8dc0880a19520767015550e472110

  • SHA256

    9d11df91076a23e06aff2cebcce4dba5ad51063ff1b8c479e1b1b581b6c54b37

  • SHA512

    188405e1a06136ed81f03382116323991e2f819eabded4ed8116014c2591674541173b9682eeef5ac6a8d241d1be2b53adc0173ebcf4015e079cf62f32ab5089

  • SSDEEP

    24576:CzsrQ375G2GQFjR5iWq0DJElzRm+t3kR8CFGBAtOau7Aw/VTqESkHk:nQ375G2GQJRRL+t3krFjOa70OEa

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2