General

  • Target

    18__ e_t___sµ__ 2,6_ G___F____ _._.pdf.exe

  • Size

    749KB

  • Sample

    240828-pl66qazdpm

  • MD5

    7cc9e26ea1d1d210b0743a04f635f3e3

  • SHA1

    900eac1771403ec7e52613f174280c0d407dca37

  • SHA256

    3d0c2597a61bef53c2468c53ff641eea3faa4ec908ed7402573d74b1f8f79464

  • SHA512

    abef9f7621f3b33b99b27435ab161c79550809859b9ae44ab309a0d72d090d85d9f09aa7a5a58ddeaeca96460080bccf09bee89a5a755facda392201c9ce582b

  • SSDEEP

    12288:6Wg8P98FAb0eZaY+OGPIKOAHLoXmdExbTfwPKrjiMNyUi6rM0Urcz0zERaYjXfI:6+18Qvo5PIKO4oXzBzXk0Urcz0zEzjPI

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      18__ e_t___sµ__ 2,6_ G___F____ _._.pdf.exe

    • Size

      749KB

    • MD5

      7cc9e26ea1d1d210b0743a04f635f3e3

    • SHA1

      900eac1771403ec7e52613f174280c0d407dca37

    • SHA256

      3d0c2597a61bef53c2468c53ff641eea3faa4ec908ed7402573d74b1f8f79464

    • SHA512

      abef9f7621f3b33b99b27435ab161c79550809859b9ae44ab309a0d72d090d85d9f09aa7a5a58ddeaeca96460080bccf09bee89a5a755facda392201c9ce582b

    • SSDEEP

      12288:6Wg8P98FAb0eZaY+OGPIKOAHLoXmdExbTfwPKrjiMNyUi6rM0Urcz0zERaYjXfI:6+18Qvo5PIKO4oXzBzXk0Urcz0zEzjPI

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks