Extracted

Extracted

• • Target
    13410b80418e08044df11f8ad92e0a2380acbfe2c2b5d649fbd9c4266e3eec32.exe
  • Size 490KB
  • SHA256 13410b80418e08044df11f8ad92e0a2380acbfe2c2b5d649fbd9c4266e3eec32
  • MD5 d631d6260412c0c7f49997ce4144152c
  • SHA1 a12b78e2c53c5be38d715d0b9bd96a6f3a68cd46
  • SHA512 2a31fecc4271b1a1b4cd53ebbbf9c46cb38629ad18cc8e13d1071737ef553d5e04854c542a60d73558ab2baea8751e814fadf2c16b84fcec416139bd76cb1321
  • SSDEEP 6144:Op+ggKWMNFaP6B0UXZfeu1s5NYjXnXydFIbZET/JMNV5zMqPUQHsarhv0xm:aBF3lXZ6NKXXydFItS/qf5IqsaVcxm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
  • MD5 75ed96254fbf894e42058062b4b4f0d1
  • SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
  • SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
  • SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4