Extracted

• • Target

    Approved quotation.exe

  • Size

    766KB

  • MD5

    0dfeb14ed1876716ea25ba25d70cbcb9

  • SHA1

    a1881912116f3041977673e3de829917ee6b4b8a

  • SHA256

    b16d4be7b771fb3202c5e48a258c4eb45c88f465be8f84084a5a82fe755a5095

  • SHA512

    c671623d67e32194da8d79772431326ea391fb41fff843df91fecfe4b91607dceadde993297ef2c7112b26197385a7a71b3864898cd4f0fab48266e869559d15

  • SSDEEP

    12288:LiKV/9THVDvfqsFPN3oPKmBczqV9sPoxrbHca6QjkkWY4LyRApKGw60Vu5aatVoi:79fq86WuCoPjkY4LyGKZ1V4/VKvm3DZ

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1