Extracted

Extracted

• • Target
    5bf661ed804f6f8e0f65e3f8d3799873f72de9d486a5ffd71b79a62012f1fd83.exe
  • Size 787KB
  • SHA256 5bf661ed804f6f8e0f65e3f8d3799873f72de9d486a5ffd71b79a62012f1fd83
  • MD5 9ce063b6697c02e33ad651e5237c4a00
  • SHA1 992e3613468587437fd90c5c1328d6ecf6fa3634
  • SHA512 4a1e95ea6692f509bb01b1a810a746b537df122fcbb9d234ef64f347f5ca25f37aa570ac1e33b9ac5425fe8553f93457133af30daf8893268f4ea2d7101d4016
  • SSDEEP 12288:sdyY96SZzpX8zm4q65MnFtc8B3bHAQnxdJBIdL/0EP7OURW8qhftONBAYJ2cw:k4KX8ninFTB3lxXqh7rWHPY8
  • TLSH
    T18A05F14033699F02E4765BF00570E37587B92E95BA21D31ACFFAACDBB93A7815904783
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2