Extracted

• • Target
    279606dc53234325b3c63298ab2d8a0d146f8dacd4ea18c6b6166ea0dc08f70f.exe
  • Size 1.3MB
  • SHA256 279606dc53234325b3c63298ab2d8a0d146f8dacd4ea18c6b6166ea0dc08f70f
  • MD5 83a3c13a4caa45d4391852a0694bd526
  • SHA1 664e8dce0ff42ef87c357fd3d00af692bdec8bf7
  • SHA512 e32ac17ed56ef5079128022a1b15da9aabec5f31ec4fc56d68047ca0885ad1389c4155a466780f93b717c538b04f51afc6b014ec1e026c9a37159ef3c65df695
  • SSDEEP 24576:WguQsVjgtNWrt8/xbv0l48uaxHuzKzR3qBxMRQjYac49I1r3F7ML6KPVictiK:PuB/rmxkluHAhq8+jY89g57OXPQc
  • TLSH
    T111552380721ECD46D86427FA4A32E37523B4ADBA6501E3968ECFBDEF79527124C04B53
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2