Extracted

• • Target
    8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe
  • Size 631KB
  • SHA256 8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101
  • MD5 9fcf97beb7fa92d40e8624ac460c6abb
  • SHA1 0051a4d406c8d1c76095169152fa633e2d35af41
  • SHA512 6aaee34c7b72b6bf7438c2f51dd5eebcc867629c52faff67b47d40b1d706b36c4b89efa0741146421dbeb8b3615304e7621b99e73f697ab7b4a13d65787b9c7e
  • SSDEEP 12288:b9j6I8jtEj1PsUwmM3AEdCvW/UGeOjv2oi7Kf/MQCQNX:b9jr8jtEKUwTdx/UEvYKMQC8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 7fafaf28fa6eb7604c61ef816cdd3e5097a0e17695bef0bf9116b6558aa68967
  • MD5 ae164b9dd3591a987b0d71dc255c4654
  • SHA1 41198cb28a31a0ffc3d14540e61a4840800681cc
  • SHA512 57fad70b175fa4f1a525fe413c8bcd87cd66b97053056c91ca912e6796ad19cc613437f49c52adf5ca20c2c54f4c0ef2a41df50cfabe0645de7e6016b5cd05f6
  • SSDEEP 96:kD7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNe43e:kPXhHR0aTQN4gRHdMqJVgNef
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Phonetist.rep
  • Size 52KB
  • SHA256 8bea279eea12ed0a17352e74808eca312b0971b0fabca6b22e0d1bfeb539e890
  • MD5 253faa8bc9f61b6117e1dbb099fdce9f
  • SHA1 98250520784061e89b5f8958b996addeb43ea394
  • SHA512 f6ee424af0763960674cafb7ff8e705381c63c1b3363fec1b145c47ea36f30f46446c5cf679ff231c06d21c92def1afd0e53304d319a2c6bdd8234cbac0b4000
  • SSDEEP 1536:vaBv24EzBKJxpHnmVLe/2OaG7gQ5wnPctHV:vaN2d2pHnmVCOOcOwna1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6