Extracted

• • Target

    DHL DOCs DRAFT HBL.dhl.exe

  • Size

    1.1MB

  • MD5

    bb043106fec5d868e6781b4b4b02128b

  • SHA1

    517b6aa452e0e8f7e2ef010e0c6dbad654865a88

  • SHA256

    23d20b7963a72be389d28c91883e912ad016fbf2a0d8d0cc12624d5652ee160e

  • SHA512

    f73463acce3ad379d10d65e662731a48cbed8fed40de94cc24c4c7063994737dd8dfddce678080e7f80a0303226dc79bf9508eed499542cf7eeabe467fdd0cf0

  • SSDEEP

    24576:Ju6J33O0c+JY5UZ+XC0kGso6Favdstb66gCLytWY:ru0c++OCvkGs9Fav6bZDY

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2