Extracted

Extracted

• • Target

    SN250123AAAME-000132_c401bd65644021efe33c932cc664b0922368000d6b593a410013a1d0f91cafe3xx

  • Size

    1.4MB

  • MD5

    11e3e342bb3dcfcd9226d191b5bea85a

  • SHA1

    cf31c6ade1840f614ebfaaf13504190dff36c4f9

  • SHA256

    c401bd65644021efe33c932cc664b0922368000d6b593a410013a1d0f91cafe3

  • SHA512

    ef553e33457625c0ff898f960e7d2860496508fffaf4da8e2f372cf4955ed43ca5f3e1789d2d5eb09412618d2519ab8957fb5e67b6b7f16d1b51b2d9baa4b6c1

  • SSDEEP

    24576:Htb20pkaCqT5TBWgNQ7a2D2dVzHFl5484hTtPIOZfFMiVyGQC6A:EVg5tQ7a2CvxX4hxPIOZNtP5

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2