Extracted

• • Target
    bac00be71feb7f3f3091eb54d53771e21eee2c422f148e8524bb09e1827e2b70.exe
  • Size 867KB
  • SHA256 bac00be71feb7f3f3091eb54d53771e21eee2c422f148e8524bb09e1827e2b70
  • MD5 c264e434f072fd7d7b4bd11689e7579e
  • SHA1 c036904eb33bea542b242b301658e109e1542a5f
  • SHA512 f3bd7efdcb7bd4b6f961c1a4173b7f85de56f6aeff20b9ea2428ef3051a8a3e4d242a7f9dbf56793d3d5188803b209a79bba951e4374beb7074ee56c60e2acd5
  • SSDEEP 24576:5TSIR8kemGEESqCLfatdR4jDarplizvogK:5TSIKkem8dg+OvLK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoverydownloaderguloadervipkeyloggerkeyloggerspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324
  • MD5 ca5bb0ee2b698869c41c087c9854487c
  • SHA1 4a8abbb2544f1a9555e57a142a147dfeb40c4ca4
  • SHA512 363a80843d7601ba119bc981c4346188f490b388e3ed390a0667aaf5138b885eec6c69d4e7f60f93b069d6550277f4c926bd0f37bc893928111dc62494124770
  • SSDEEP 96:ojsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3Y/NqkzfS:ojsvWyNO81b8pCHFcM0PuAgkOyhIFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6