Extracted

• • Target
    1ae3530acc95583b7628c8e455ff1aef752ddffba7eb11a2c56b000510c46ef6.exe
  • Size 560KB
  • SHA256 1ae3530acc95583b7628c8e455ff1aef752ddffba7eb11a2c56b000510c46ef6
  • MD5 ff1fe53aa52bd84991e06022c55f50ef
  • SHA1 4f8fdc54bca5a2de7aefa4484f072151c1c898b9
  • SHA512 e7094f610f03b4464c96ccdfd8b3979a02e73077988b7deab7d66715e85b0ea70b21b43b422c56c9f3b355c14c1705329c4be87a1803ec7cb9f5ea125c404e6c
  • SSDEEP 12288:4J9IWHll0vCFE/+ThjJW4ZRUkSr3bGdMcSDp5:4JqO0vOC+TVY4zGr3bhcSt5
  • TLSH
    T17CC42376B8B0C5F3E727927307B9393F9EBDE32C414796A71781460AB8535124D2F60A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloadervipkeyloggerkeyloggerstealercollectionspyware

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
  • MD5 12b140583e3273ee1f65016becea58c4
  • SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
  • SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
  • SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
  • TLSH
    T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4