Extracted

• • Target
    092b7de8fe08fbf5aad89b80f5b19e1469e1c66986fae44ca36c9fda366857a0.exe
  • Size 884KB
  • SHA256 092b7de8fe08fbf5aad89b80f5b19e1469e1c66986fae44ca36c9fda366857a0
  • MD5 37bda1fc6b5d7299f70e6ff85fa68b13
  • SHA1 eaafb4240d049f7f9178c16c9898a033104d7008
  • SHA512 523cf368bcc18fb27f49a0d73db2c563909b989bffcd3d5c04fd1d1f8468dd8719b286d1bcf99ad94d210d0bf456b993f67410bdc6b972a5aeb1a52d16b425c6
  • SSDEEP 12288:cGnK34dT2W9oZz0Y4f59CNZEBThBZV8MHRybrJyEoruPpj7ye6K/CmajVRdEx:cGnKIdN9oZz0Y4ffCuVFxorJtorw9De6
  • TLSH
    T10A152364B333C4B6E633C4F44C22B95B05BDEF5056E46F3B16613A18D4B9B1B294BA0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderguloadervipkeyloggerkeyloggerspywarestealer

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
  • MD5 192639861e3dc2dc5c08bb8f8c7260d5
  • SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
  • SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
  • SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
  • TLSH
    T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4