Extracted

• • Target
    a0218475b35ac5a80bb3e4fc9ae77dfcb62dd338ed277e9fcaa700286dad3aed.exe
  • Size 673KB
  • SHA256 a0218475b35ac5a80bb3e4fc9ae77dfcb62dd338ed277e9fcaa700286dad3aed
  • MD5 90e1c0e20489688b2d95673d3382d7a4
  • SHA1 1c93cf53715ae2166cde90fbb13b90241545527a
  • SHA512 308ff18be86acfac351b8b59cbd7cf41539cad8db8adac840b81a83fe610d8f65be2bf26a1d0bb730fb670fdae53b197a66b1860e10900938b4ad4f7cd1c4b24
  • SSDEEP 12288:uNBRGXL3AQ+mvmE0jjG+zbI9VLg7chG/PtBL+ftOcGDOdP:uNBRGXL35+muzW+XegNPPLEc4P
  • TLSH
    T172E423D32BB4C066CD5147F09A3A0A760EB89E7D65F8190F3772BF897E710C6861A712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryvipkeyloggerkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
  • MD5 cff85c549d536f651d4fb8387f1976f2
  • SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
  • SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
  • SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
  • TLSH
    T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4