Extracted

• • Target
    Factura sillón María.exe
  • Size 609KB
  • SHA256 4815643bf9e3c51ae12955f15fe3a7a54fb41b37bc1cdcf41ad6b7b1b52adc95
  • MD5 913c3d4c9b490ed522b8c5345195d0d6
  • SHA1 e1c546bf8fca8d8c0c12335668bab4f7bae21067
  • SHA512 10100a28253ff7d23dbf90626d9ac872cd9bfc2810023f30042e21a712a9cd73b28f640345aa2bc58b09f1169166cc93a59301ef2b4f3aac2dfbfe9ffabd71df
  • SSDEEP 12288:HUL92GRoUpRgPhLjQZloDSzafxDTOywdtHYRnMi:H8FKCmfQ75aZl6RUb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloadervipkeyloggercollectiondiscoverydownloaderkeyloggerspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 5bee24fef5c0f643adc7ee02ccb6e80a72a4eb30d9d326023ac03f0ffbc4e624
  • MD5 376c1b784a3cca9d10ba4ca5d8cb55d2
  • SHA1 ad12f8ebab5b4b58eb7d5368469e82e2442b089f
  • SHA512 6f02f0d878c228de114dee6b0df85152745b43893a252b2e9c309ba943ea56ab1ee678e42d9b0a89162e2bda627d396c2933c02e1c42d0169ac6e05ff3af4bbb
  • SSDEEP 48:S46+/pTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mzofjLl:zfuPbOBtWZBV8jAWiAJCdv2CmmL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
  • MD5 8b3830b9dbf87f84ddd3b26645fed3a0
  • SHA1 223bef1f19e644a610a0877d01eadc9e28299509
  • SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
  • SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6