Extracted

• • Target
    32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64.exe
  • Size 616KB
  • SHA256 32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64
  • MD5 18a1223e31bae0f76993e5d1cd9531f6
  • SHA1 e7725a65b8f5952b9bdf52a0fd12d8fb96fa0df4
  • SHA512 932e4c297a55e1e9534ecf7efe74b6373a2a52bc34b71da681de08be5e57be24f3a4168c79f189c4d5dbd1b77282f2e17e6a7e24cfd47596c60761dcc5b19cfb
  • SSDEEP 12288:b9jwVqaTirDOOiPtV7VxjkE0jv2oi7Kf/MQCQNf:b9jiOWtvxjkEovYKMQC8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 7fafaf28fa6eb7604c61ef816cdd3e5097a0e17695bef0bf9116b6558aa68967
  • MD5 ae164b9dd3591a987b0d71dc255c4654
  • SHA1 41198cb28a31a0ffc3d14540e61a4840800681cc
  • SHA512 57fad70b175fa4f1a525fe413c8bcd87cd66b97053056c91ca912e6796ad19cc613437f49c52adf5ca20c2c54f4c0ef2a41df50cfabe0645de7e6016b5cd05f6
  • SSDEEP 96:kD7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNe43e:kPXhHR0aTQN4gRHdMqJVgNef
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Barothermogram.Upr
  • Size 53KB
  • SHA256 056f551f53fbc53b8cdff908b1ec964a889380c9f32a17d716f74648530e7849
  • MD5 8d8d04ee075c2f13f0271c8cc25daaae
  • SHA1 5ada5f61d91f3839dacfb4f325b272d762e5eff5
  • SHA512 b34d171d199a44c44b9343c32b79e7a3c229363a72c808c5a5f6b0396c0b5dceafbd05b514dd3993d2b2063f184671745acd06db4ee3ced1826af4062cbb4126
  • SSDEEP 1536:+AJNh/1faPGhz3Qd90wRtY7TXKWcpq1JudXllg:NxNmk3Qd9JY36WFX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6