Extracted

Extracted

• • Target
    Detalle_Visita_I_137894350961238.exe
  • Size 325KB
  • SHA256 4daa854b818e6c287e5249333b23332501196cafaf0656976bee1df800d2fae6
  • MD5 71eaad56216c7dc33ce2154e63fc0f8c
  • SHA1 dbea9304b0718c425814273e24e7f9a1a5e9be26
  • SHA512 54e30ecc8d8e2f24c4dbe5d97a66ff6a9a631754818a7aee4e2a8b3eb6fd71aadb692ed1f31853aa240d675c9f4e693afe8c505a77eb8fc475d8eb7727e4e3c2
  • SSDEEP 6144:qcBvWHOjyRV4z/RaqwGU5v32vQ0sdYFo92utY8Z:HSRWz/RaqwL3GRuthZ
  • TLSH
    T14764CF92B344D853D5B007B058B7D97116616E3DB870960F33E5BE6FBBFA2C31A06606
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
  • MD5 12b140583e3273ee1f65016becea58c4
  • SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
  • SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
  • SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
  • TLSH
    T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4