Extracted

• • Target
    Transferencia realizada.eml
  • Size 351KB
  • SHA256 8a6e2f21218fd9ea8daa69fc5a1c62d438087718a281524948e9f02a03694eb1
  • MD5 c360cbe26864b433aeef801e980ef99a
  • SHA1 3a9056ecf1174a13d212ed0d2f924e9d3538c5aa
  • SHA512 20308c0e7dfe750812c323df1aa010f544b294ee00bcb72f3d592ff2f03f3a573abcfa5378e8d45575cae0ef764aba79ca6b9fc413728e0ff2e1c14ad9fa8acc
  • SSDEEP 6144:aR8w10znMgBgZwMVDVLKeSQOpLyZJEVUMOAa7Dl63VMRklULfddFO5a/:aC/znpBgZwMNV+gGLWEmAiU3qRokf7FR
  • TLSH
    T1337423071EDB97CF05227BF1B27B7EC2715ACB81198E5265807AC36BA4C41146E6F1B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  adwareransomwarespywarediscovery

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    pago -898923-887340450909437-93434.tar
  • Size 249KB
  • SHA256 33256269f89069122c73e6e4bb0e2af65428cc80bfe19282637c4e6765602629
  • MD5 0e8e6035525273fdbe044a337aeff61d
  • SHA1 4c8916f50ee372ba1d46ec5e8d4fbfa41a3711a3
  • SHA512 95f62559275bb891463ab8b456498aa4c321066047190994001380d2d27f1be7d0b00d9640bd2617a94dcf0c2672956affb26d2898f8c4590732cbc6cbbf5753
  • SSDEEP 6144:OWWWhZEC8T7VwMa99/qgj+Njv11OOMjjBzefgQp:l9YhU/tydbwsg+
  • TLSH
    T1DB4423E72408C5C2648FE9C1D370E0F7AB5C3D758EE1653AF68B8D557B28AA9CD3A400
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    pago -898923-887340450909437-93434.exe
  • Size 283KB
  • SHA256 939cfd0ed568db0f2e856a4febb9f8fd96aa031086cfc0e8c99a1cbaaa86796d
  • MD5 5242343341f0cef4bb76c23e011dd78a
  • SHA1 bdc84402f753c6f8d20017d6ee12c771929ba274
  • SHA512 70be956cf7eca891e4d6e6783ac5fd6a805ee26cff669e9a12b5db79aeab71452a90e0afcb716fd907830e0ef412144d3f168609bf928e730237f16cb87243b7
  • SSDEEP 6144:cX45rw6BsvoivXiIExdWlCLZEkL/M5hlPDr6QJ6:cX4pgvXiVdWlyZtTcDrXI
  • TLSH
    T1875412459654C0A2E5B30B70AD7487B56FDCBE2A2995034B2701BF8FFC336A50D0E29D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral5behavioral6
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
  • MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
  • SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
  • SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
  • SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
  • TLSH
    T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8