Extracted

• • Target

    CAPITAT SC 2025-2..exe

  • Size

    1.3MB

  • MD5

    acef70ec8ea3cdae725c421e22d4def1

  • SHA1

    014276631452de17d302a315d6353f58af42a5eb

  • SHA256

    841f58752bc745d62a108bff362df80ca7694a612843de53f8fe4b228089e9da

  • SHA512

    23c7fe41a29476f14bf786e5e6c35e631570bbf7d6a50509d6bb1cd1d42f4f5dce7abb1f584ac18dd7d800ac91957a0344de13af1b5ab81220c2086645b3b271

  • SSDEEP

    24576:iigUXrbkXJvAU6GK+iqL0TiyIJeppSGx8YR/REoF+:5W5vAPFc+iXHGxrrEoF+

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2