Extracted

• • Target

    COMMERCIAL INVOICE-0125649.exe

  • Size

    1.3MB

  • MD5

    e5daebb3ae95ef647abae065c439cd3f

  • SHA1

    40a9a3d08bbcf8781858bca10560cd049c6b2415

  • SHA256

    12d1e667249b08f89e4ee20b883da8d2496b5221bb0d4241bcc933aa8146ada7

  • SHA512

    27d85798b3aa7e61c197365ab271cb6659f334895e6be4264973e4cf9270bfff3563c5a3e58b18496491142b7317d91c01ecd3a91ec37934d459972b0a11c30b

  • SSDEEP

    24576:eAZBbTOOFGoKtlGO9oFSN+yiQ7srt1JD6pOSsSSBy:eSVTOIGoKtCFb6kt3LvSwy

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2