Extracted

• • Target
    195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28.exe
  • Size 568KB
  • SHA256 195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28
  • MD5 0fb22642c0c3cb88ec40a1f387d35b4a
  • SHA1 2d8b55e21c75731dbf5269976e915b041674eb66
  • SHA512 1706406d2a8dfb23bea12a9769f37762083c9826f038de90d8244f36a70977a7624dcd08fbea4f5643a165ebd93e4917eeab7d6696b2b417d4876c21dff46038
  • SSDEEP 6144:/wq3NpQ3wDIywUF5ykHERIe6MyhdVgWfMnfYyumOk6mgcbpiOgizVaSuQ2/z/fw:/zcae65hmnumOkrDpupQ2bo
  • TLSH
    T135C4BFA0F611D9EBD5A709BA8CBBC4302167AD1E86D1111F32ADB62825B335211DFF0F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderguloadervipkeyloggerkeyloggerspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4