Extracted

Extracted

• • Target
    FA_9198_2026_M1_kod+EAN.exe
  • Size 1.1MB
  • SHA256 db67b691c4e7cdfcbfe16adc1d423dd716bc2ef052c7460940cc5124317ab491
  • MD5 e3ae56d8e73a7740a0907007edc31282
  • SHA1 57612fd4adb9b840a977349de5e52b9dc668468d
  • SHA512 38d63698b06edb3ad33f41ecf27d70e6764b0c75c7b0d48c80ce2ad907e0a668b76648689de738d0a52939ded7934c1d2dc89fc0eb52eaede726190d41df0f26
  • SSDEEP 24576:YPLWT3RjFs/soZCna9ZOIQsyz5N6/UzfuVn09nKVaA0fK5:Y69jFKsokXsyz5N2Uzan09nKVax
  • TLSH
    T132452352DB34DC43F67200BB68A7CAA7ABA566B662884133B376B3E51DD10C1053FD9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
  • MD5 8cf2ac271d7679b1d68eefc1ae0c5618
  • SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
  • SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
  • SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
  • TLSH
    T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
  • MD5 ec9640b70e07141febbe2cd4cc42510f
  • SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
  • SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
  • SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
  • TLSH
    T156120992E6A450B3C5E6133F35AA2B2DCBBD5325B0922C0083738E4979795B66E38347
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6