Extracted

• • Target
    cbbfd15208f4d0765ec912b33ca8d21559a7ad3f5e3ba9652dea8973c410715c.exe
  • Size 373KB
  • SHA256 cbbfd15208f4d0765ec912b33ca8d21559a7ad3f5e3ba9652dea8973c410715c
  • MD5 f4684385ea3e4e64a8ea88449d5d09c7
  • SHA1 6b48ca9b415e0c8fc1d7d75508d4164901485f5e
  • SHA512 f64921585a43f298859a65eae4e156954687c74922cb27ed12952cfdbf8a08b8cfce74fca3026e43864f504a0a956f0920f2606306ad61e91c1b4e428a632fb2
  • SSDEEP 6144:cIw3kYdpjYtzUh74epAZWkF0bu06YiE2dr2DCqEATdvEsSgUG+Qdgd9SAIbOXWhk:NYdpU9Ut4TZW00bj6YirmfEXj+gjFIbq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
  • MD5 9625d5b1754bc4ff29281d415d27a0fd
  • SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
  • SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
  • SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4