Extracted

• • Target
    FR24037694.ZIP.exe
  • Size 614KB
  • SHA256 a5272cb5bc6e3ab5e6769c30edf0f711db1c6880a9d2f303c99042b90f5f19de
  • MD5 c2a8cc1a3720b550cb45d88ca3be5ca1
  • SHA1 c43d20b402bedfa7d176b75f30aef49de30a4d80
  • SHA512 a882c0380fad620d6a6986c00305203fe02f2fdff111f53aa03baf2f4f8e107f431272e317de4c7f5c0c2f80eb97af1a51c644b3bb54e82b0866cf13c9fc59e8
  • SSDEEP 12288:KUK4FqvEdbI5Sw7bUEubfN8V2Kxy1NhLNaXYfZkws/:Kh4Fqvk855/ULf+61DLNaXYZk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 5bee24fef5c0f643adc7ee02ccb6e80a72a4eb30d9d326023ac03f0ffbc4e624
  • MD5 376c1b784a3cca9d10ba4ca5d8cb55d2
  • SHA1 ad12f8ebab5b4b58eb7d5368469e82e2442b089f
  • SHA512 6f02f0d878c228de114dee6b0df85152745b43893a252b2e9c309ba943ea56ab1ee678e42d9b0a89162e2bda627d396c2933c02e1c42d0169ac6e05ff3af4bbb
  • SSDEEP 48:S46+/pTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mzofjLl:zfuPbOBtWZBV8jAWiAJCdv2CmmL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
  • MD5 8b3830b9dbf87f84ddd3b26645fed3a0
  • SHA1 223bef1f19e644a610a0877d01eadc9e28299509
  • SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
  • SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6