Extracted

• • Target
    251378.exe
  • Size 597KB
  • SHA256 07ac845eee39222cc487d6dfe0a50f12874af6b05ea0390b5d6e4e4e64d3e18c
  • MD5 d25fb723e2a5fd1596da0024d239298e
  • SHA1 0a4d0993ccf384fbc7714e0dbc7371bff9947209
  • SHA512 28dd34a781361de18868d856dcf790672f125f25f22512e8736c8b1ef6c335635c183e2dc941dab1d0a9dbcb01178de02860358c84317ab9ccd7654232d74111
  • SSDEEP 12288:+X4eIO/YyqmEYuanVHPC4zMprecccIB+5d1SBnTYKFPGfIC0v5pF:A4eIRyzEYBvRH8bkyIL5b
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
  • MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
  • SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
  • SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
  • SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Overdiversifies/Thailndernes/Arrestforvarerens/explains.com
  • Size 6KB
  • SHA256 94e2fc3e0f5558fc864418890378052b65c99f53ef11a8541000021cc88279d1
  • MD5 8a90bf7c513221434897340cf6c0f581
  • SHA1 40e6f9c8b8e022861aec9b455c0ce12362c10409
  • SHA512 a576a64b6682d872b39da7c5c51861d4b32927cc09f6313562e2d43e39d281b1b90ba2430fdb2feb3802c8df46732a9b8dceb1e9e223b136315dc3e9fd384b23
  • SSDEEP 6:j+LYzUzsQLCiL6zALYz8XIz6mEzk6e2zIzUffQveX6zqLOLCL7:fWsbALG8XWm4bsI0Sc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6