Extracted

• • Target
    Tender QUOTATION - LH22000309AA2025.exe
  • Size 1.5MB
  • SHA256 54a0df8fb6dc686b5d58cbffe89288783ed46ab6d067d6e67446efa61bc0e982
  • MD5 0fc2bfe1f46ef5fddd5f16e2994785e0
  • SHA1 7a8693a47bb5b9659e5853098ca9d244eba2dd4e
  • SHA512 b2022e8acd9e9ad6cbaebd1a860e45dfc72d1bc8bd3547a8f57196cac58e1ea740c9a3dea43f1142c04e4ce512280b5110ed118b0c62e939906580327c2ca920
  • SSDEEP 24576:1tb20pqaCqT5TBWgNQ7aesuLF6As/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mrg5tQ7aex5sLNiXicJFFRGNzj3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2