Extracted

Extracted

• • Target
    941a189bd84102c13255835bb2f4df77d9cb126be4e54faa179b9de469375fbe.exe
  • Size 1.2MB
  • SHA256 941a189bd84102c13255835bb2f4df77d9cb126be4e54faa179b9de469375fbe
  • MD5 aa6fe985cad16a72f80f8ff5d23d35cf
  • SHA1 afbf1713a312efaa5bae37c5763818a801cfb195
  • SHA512 7fc269ccb157021f8510821ef6c362a7f71cb61fd4080328fd9844f33df9b93c2ddecb5953c5fbad727452aa4db2a668477686c62cb9f9a97fbd517040164f70
  • SSDEEP 24576:uRmJkcoQricOIQxiZY1iaCuZqjQv3xtliBJo748j+emS+gbw:7JZoQrbTFZY1iaCuZ5Dlino7BT+gE
  • TLSH
    T15445E122F5C59076C2B323B19E7EF76A963D69370326D2D727C82D310EA05816B39763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerstealeradwarepersistenceransomwarespyware

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2