Extracted

• • Target
    d2157f5d283a3bf6562517c2b0ccd19752a529b324ce969007ce2d0d73aa0cb1.exe
  • Size 555KB
  • SHA256 d2157f5d283a3bf6562517c2b0ccd19752a529b324ce969007ce2d0d73aa0cb1
  • MD5 9fde223287140feb349f16157ecdc3ce
  • SHA1 0976be186b49ff161da814eb32e6f7aa5c68d7b1
  • SHA512 7407488479790d255a4f1d27eadd0464a288029e0e12a8479f632d1e7462ae561452ec4c2e068effc914f8c0b142872c8554f381821bd43878bf304c6850630c
  • SSDEEP 12288:UJMzItE0l7gADWqVMijRUkSr3bGdMcSDp0:UJFplHDBOilGr3bhcSt0
  • TLSH
    T152C42316F5B0CCB7EB3BD7B10549AD2A8EBBF3284385DB431354AA47BC132534E1525A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloadervipkeyloggerkeyloggerstealercollectionspyware

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
  • MD5 12b140583e3273ee1f65016becea58c4
  • SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
  • SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
  • SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
  • TLSH
    T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4