Extracted

• • Target
    9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8.exe
  • Size 576KB
  • SHA256 9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8
  • MD5 a65a4249fef77e1c648070c5adaeae14
  • SHA1 d75ccb8ad7b09f8f1a82ab532b796df6b1960ac4
  • SHA512 b4759e1b5b2a26caf58f9224e53523ad2dd61a0ee8af5bcea5992ac07f50ab3ff5dda09d5ad56b4f08fc8a95b42a526f8cf23761f69ea92d13d8a0944ca3cc17
  • SSDEEP 12288:AfHYAmd7zNb0lP5QyMsiwN0UoJG43s+1Pkw:GH7mrb0lBQSiwCJGiPV
  • TLSH
    T169C4E0567FB5C416CBAA0A7CCC63BF4E95E45C7034229693EB10FA799978380FD0E216
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryvipkeyloggerkeyloggerstealercollectionspyware

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
  • MD5 d6f54d2cefdf58836805796f55bfc846
  • SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
  • SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
  • SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
  • TLSH
    T16C426C496B619FF2F61A473719B37F264B3CEE1412E446DB8FD38446A8A01E721362C3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4