Extracted

Extracted

• • Target
    b5b7485b8d9579167eea5ff7728aa336974563a033e602ce35da0eadcd194bb3.exe
  • Size 687KB
  • SHA256 b5b7485b8d9579167eea5ff7728aa336974563a033e602ce35da0eadcd194bb3
  • MD5 2134994dc9e835c4ca0faab62b1b0ef1
  • SHA1 b0631227190864af8ffacb8679583401f155ccee
  • SHA512 301d5bef4dc483f3ae3f90116125cc304279c9d712209446900204b46dd2920d948cc728b338907fbc68ea648b12c43a758dd703c222755c69babfe2e4805aa5
  • SSDEEP 12288:0TuZA11DHNN9VyeNQAJQYyii5fUUyuV8gcMcHKsVlp+7IYcUEGHh9yNp:MuZA1dNN98eNQwyH5sUy6crHzNOEGHs
  • TLSH
    T10CE4124533A8CB12D6B60BF815B5E27047797D1EA932D3598FEEACDB3522B149E40B03
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionvipkeyloggerkeyloggerspywarestealertrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2