Extracted

• • Target
    注文.exe
  • Size 501KB
  • SHA256 7e72540284e2469fd10a11a46338a02fc1a25f7e681211248f95dbf01c9a6d8a
  • MD5 51bbd1b8f4012bfea73c4a2743ff5d26
  • SHA1 4faafe20f920ed4a008bf6b36afdb3581c473da4
  • SHA512 d34f553377c1e78bafd76ec84b526803729f01563b54c02182435b0a897c93ff427f787f90eae4fc18598c488506464cc0e5f37767f4211ecf5f85dc71ab80f2
  • SSDEEP 12288:jnqpyMcdbTjzibDzCDXPV/s92G8vEE/FEC4VP4:jnqpydj8voP+UvE4CP4
  • TLSH
    T177B4E091F696DCE6E8360372993B5E352763BE7E89700B0F269C72196DB33920027D47
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
  • MD5 792b6f86e296d3904285b2bf67ccd7e0
  • SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
  • SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
  • SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
  • TLSH
    T140425A0583618EF3F5962D3C00667E2F2B79BE3416F140639FE34481A99A1CFA975392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral2