Extracted

• • Target
    ee5b7b7d9a61c1b9f09d873d57e56f9b83a3c5e8e94d82cf5cb72a074a73b962.exe
  • Size 1.1MB
  • SHA256 ee5b7b7d9a61c1b9f09d873d57e56f9b83a3c5e8e94d82cf5cb72a074a73b962
  • MD5 15acfe2e9d274dbde21a757d2e8da608
  • SHA1 cbbea29c9ac017046a7f09d09b7a4a2859d45226
  • SHA512 43ebfd39bc93bdb71722610640639fd2f1ca046ea1a828b249dfa7e15a257787bbbd51ed27080068007f25eeb2c099101dce8e8cc76f8550d0203621b5a2ab26
  • SSDEEP 24576:a5EmXFtKaL4/oFe5T9yyXYfP1ijXdaRjacVVfz9VmKw:aPVt/LZeJbInQRaR
  • TLSH
    T1B245BE027391C062FFAB91334F5AF6115BBC79260123E62F13981DB9BA705B1563E7A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2