Extracted

• • Target
    12ada0ff475cede5fb6a97e92c28542ade9e3ecbcbbf97e8b9b7ac2df1bbe752.exe
  • Size 335KB
  • SHA256 12ada0ff475cede5fb6a97e92c28542ade9e3ecbcbbf97e8b9b7ac2df1bbe752
  • MD5 139ecd0d4cc234c0704964d5ef17db70
  • SHA1 ff9ee71294efeb409d1010942f2830ca48b98d3b
  • SHA512 df8764ff4f0480180e29d0acf5648e7e0f2abd80f4c9cada1b776cd51ece0c5a9fe5a7419b21452edfa6e81426d15193af68b1e207e58d7b131b3b924ed4265d
  • SSDEEP 6144:MR+xXDfYHsMliIpG/WjVQlXbW2ztp59HTPI7/LyJVvctRI2eJZCCBu7gPcdA/Qeq:UMwHsM8ujeLBztRHGDMZ46yef4A/XJW
  • TLSH
    T14C74121A61E5C463F1960BF43D7652777F32961104669A4BE3C08B8CFC387A2EA07B0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderguloadervipkeyloggerkeyloggerspywarestealer

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
  • MD5 0d7ad4f45dc6f5aa87f606d0331c6901
  • SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
  • SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
  • SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
  • TLSH
    T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4