Extracted

• • Target
    d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82.exe
  • Size 394KB
  • SHA256 d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82
  • MD5 36f426e8795e75bd29b7209418214b83
  • SHA1 7eeb6f846c97a788b01e829e050a4e2f6a0e1a97
  • SHA512 59bd410c3a89fe0ee978347c4e4a55fd9c4714383cdac80cf1abedd11154dd44119f3bb50bbe471e70d6b32453fe2bdd23b3607c241502e0bc87413d7c6ccbfc
  • SSDEEP 6144:rgORajLOfFhInrUqnmozjKLGfF06AqNps63WvsiU8gt3BzSIMKlqf:rg/LOMUQ7jKOAqN2Vbut3BGIMKcf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoverydownloaderguloadervipkeyloggerkeyloggerspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
  • MD5 564bb0373067e1785cba7e4c24aab4bf
  • SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
  • SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
  • SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
  • MD5 48f3e7860e1de2b4e63ec744a5e9582a
  • SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
  • SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
  • SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6