Extracted

• • Target
    291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431.exe
  • Size 390KB
  • SHA256 291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431
  • MD5 1b6c6df79e70ff040bae6f73f444dedc
  • SHA1 006e686d101eddc5027e7e79a2a1dbaefc2f4604
  • SHA512 2e2ffbdbc3f1c1d7d4d59634ca6eaa6f8b45a3c8b8dfd91121ef938036714a7703a33779318c7ee74afbc072cff7d888eca9cbd6feadf07ce5344353bb594d6d
  • SSDEEP 6144:t4t6Ls84Wwhvn3yRH1YnCdIkbuTBnNiGDdp5j87LcO/3u6t:tkRW2n3iHAC3iTiwdp5j87Lui
  • TLSH
    T1118401517340E4ABFA5047364E6BEF6652987E253CA0464773D0BFDC3ABE210B646303
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4