Extracted

• • Target
    8f1da96e55e6f50d07fb3dc64c12047697ae9128e63d4dbae80c14646d96e192.exe
  • Size 905KB
  • SHA256 8f1da96e55e6f50d07fb3dc64c12047697ae9128e63d4dbae80c14646d96e192
  • MD5 250c8f4f3495c1b05572a48915224aae
  • SHA1 94ab3db1927d7109f77e1b6c218f9cef5c8da4b0
  • SHA512 759778a0d450e261aa2b3e9c31c8e3ef66edd3e92d1199c0724ff0790a85e9b9373c112f5ba87b36756d4a96f0eeab8d2095117d36834443f69a1e3bd0c021c8
  • SSDEEP 24576:gN+O0nv35b7oMXiJ964/NOjzuHG91mRKvZUR:goO0v35b0MXm9RwpXSR
  • TLSH
    T1CA152391A354EB73C4CA6535EC2F87FB9A0D5E11D4B85B0F2680FE08783530B996A3E1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 5bee24fef5c0f643adc7ee02ccb6e80a72a4eb30d9d326023ac03f0ffbc4e624
  • MD5 376c1b784a3cca9d10ba4ca5d8cb55d2
  • SHA1 ad12f8ebab5b4b58eb7d5368469e82e2442b089f
  • SHA512 6f02f0d878c228de114dee6b0df85152745b43893a252b2e9c309ba943ea56ab1ee678e42d9b0a89162e2bda627d396c2933c02e1c42d0169ac6e05ff3af4bbb
  • SSDEEP 48:S46+/pTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mzofjLl:zfuPbOBtWZBV8jAWiAJCdv2CmmL
  • TLSH
    T160C18374B3C248B9C491513768A733D36612AE746784600F9B6711AA38209E7AD3EBC3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
  • MD5 8b3830b9dbf87f84ddd3b26645fed3a0
  • SHA1 223bef1f19e644a610a0877d01eadc9e28299509
  • SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
  • SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
  • TLSH
    T10D325D06235081F3E1914138846B3E175B7A15069BF58E97DFD38646BE30BE7BD79503
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6