Extracted

• • Target
    258292744-055928-sanlccjavap0003-9563.exe
  • Size 609KB
  • SHA256 63d207b04e2c262db67b0bd741361abc22dd6b3fe5a95a2dc59a234fc67d0c7d
  • MD5 089ee90218a2a85374f7248cf2089025
  • SHA1 b382df0b83eef5639101466114b4208274ac629e
  • SHA512 bf0ad26be5c4df5c5add3d1742924738a1eae1c13f06dccb44375d2348dc9ddd021bdf2a6be12f118d19088159a17bf67f452a5a53b102a2df24f2285907705b
  • SSDEEP 12288:OU0TtRM31sMFXNxqem1hA914hlarhM84gl:ObAFsMJ/m1i9Ch0Vv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 5bee24fef5c0f643adc7ee02ccb6e80a72a4eb30d9d326023ac03f0ffbc4e624
  • MD5 376c1b784a3cca9d10ba4ca5d8cb55d2
  • SHA1 ad12f8ebab5b4b58eb7d5368469e82e2442b089f
  • SHA512 6f02f0d878c228de114dee6b0df85152745b43893a252b2e9c309ba943ea56ab1ee678e42d9b0a89162e2bda627d396c2933c02e1c42d0169ac6e05ff3af4bbb
  • SSDEEP 48:S46+/pTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mzofjLl:zfuPbOBtWZBV8jAWiAJCdv2CmmL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
  • MD5 8b3830b9dbf87f84ddd3b26645fed3a0
  • SHA1 223bef1f19e644a610a0877d01eadc9e28299509
  • SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
  • SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6