Extracted

• • Target
    Drawing.js
  • Size 26KB
  • SHA256 11eb1ef781593cdb86df5145af87119a3eba1c78e894f927f718378e012b7d24
  • MD5 68b5174aee546b067015994bc18a1e13
  • SHA1 3cc3cd78cc804d2f91f83b7e2e4935d7b9e02d0a
  • SHA512 e829899c7f5c44cd45e8e4669cf1838bf3ec06f1efacb886ca2cda4f6c2f53618e405614d273342a2f1efaeb828f9a32a8e813e1689b6630566efae842d2cdf3
  • SSDEEP 768:L5FvV/HygaezWeclEDPn0DiMWDQV5FG2GdiT+bxdM2dvhtDwMgzh/WgSGxXxUWlI:L5Fvxae1c/CeFk
  • TLSH
    T15DC20B444982788463336B3EEB1B98D5F7BB096B01844907B8ACB954AFB5D08DEF0DF5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2