Extracted

• • Target

    kelivn.exe

  • Size

    677KB

  • MD5

    4875ae9940b3b14f9c6c9444f20d9dbe

  • SHA1

    185cfd7bb21f13457c12a848f6c7a8372e7ef2ec

  • SHA256

    18036ef7ea07672835b6f92dba5e92a833be93cc1fd788e050a64b2a931c97cf

  • SHA512

    0c864435332a281a9669f65474a02fa61c8650d47338571016b75a3df8a7cd69adb5a1945e7be8fb33446a600f2c6e82a05e527aa11b9bd76968eb6621d28f28

  • SSDEEP

    12288:z+qCR9W/vWvSca5Sxm7T4qvqMvbcvYDfgabdi3Ki8ejxXiT76pCafmCeuByUt1A:z+qCRva5Sg7HTSYDI93KihO7WCafmCex

  Score

  10^/10

  guloadervipkeyloggercollectiondiscoverydownloaderkeyloggerspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    9b38a1b07a0ebc5c7e59e63346ecc2db

  • SHA1

    97332a2ffcf12a3e3f27e7c05213b5d7faa13735

  • SHA256

    8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c

  • SHA512

    26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c

  • SSDEEP

    192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r

  Score

  3^/10

  discovery
  behavioral2