Extracted

Extracted

• • Target
    Detalle_Visita_I_137894350961234.exe
  • Size 316KB
  • SHA256 79a184c05789e4479d16d15a22206de124b2102b861dc4ba050c2aacb3ef834e
  • MD5 fec9198dac87022d7c6fc56e1e18ed62
  • SHA1 4beb0a2628da83bb6b0bf15ba48f36343db3666c
  • SHA512 55639757de03581d741dee7fcb9e39409c9c41d0e4aee1fd16ca2fa5ffa0c9938043ad02b39b572da740e7171ab20c97ec9dd5d9e813d1a7462f68a411d25d4e
  • SSDEEP 6144:ncBvWHOjyRV4zuAtanxSce0eutJ+p3Yw2Iva1NlTA:cSRWzuA25e0fJMZ2IC1XA
  • TLSH
    T1F264C091724494A3C97007B049BAD53652A15E2DB9B1D20F33E1BE6FBBFE3C31A16607
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
  • MD5 12b140583e3273ee1f65016becea58c4
  • SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
  • SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
  • SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
  • TLSH
    T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4