Extracted

• • Target
    2128ead29cce1eafd2e44ee35c8e3db44249032bf55f24b984fa83d857b283c9.exe
  • Size 890KB
  • SHA256 2128ead29cce1eafd2e44ee35c8e3db44249032bf55f24b984fa83d857b283c9
  • MD5 7b9b3e2b1046dd29b7f0a75587456400
  • SHA1 1faf55c1d263cf4818cc60a2454f084c80fda463
  • SHA512 7293c30033e2d1bf42f41afda0a12e5612875288831c1245d6492cc1d03ce2186d058665c4662c5427ed0105a4fef0d216e28a6f2ad998277a91a9cfa33ce5d4
  • SSDEEP 12288:Nd9rODPvTA4/JN3ybQAuWTEbnXJx3RkIPybnh/TezQJGMkMgpn34yeO99+DyaitD:0jvTASJybQWCXvRkIPenJasJ6lIyh0IV
  • TLSH
    T1131523023D81C4AAD2561D76DC7DAFFEBAE16CE5E540491713843E98F87AAF35C09B80
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderguloadervipkeyloggerkeyloggerspywarestealer

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
  • MD5 a4dd044bcd94e9b3370ccf095b31f896
  • SHA1 17c78201323ab2095bc53184aa8267c9187d5173
  • SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
  • SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
  • TLSH
    T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4