Extracted

• • Target

    Factura1-2501377.exe

  • Size

    735KB

  • MD5

    ba1ba279b7001f7a2062f51e4327b49a

  • SHA1

    67051fb8047015d225df80754353c95c256a337b

  • SHA256

    86d4c0b6d645041101606bc402ae23455d0e85fc4894455984d60855351ba2f5

  • SHA512

    ce5f96faffc09cf4ec1ee89426fceb830ed1b3e2451fe893b3528dde86e531ab5769c774ecd625b50d250dfda41ee285808dfbbaf7cbbb1da89da2b95033068a

  • SSDEEP

    12288:j7QiKaxPCJ9oQSX1vT8sqnqsP8lAyP29J8qUo/Bg2AcJN:/QiYJ9lSX1UqsEf23/BMcJN

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2