General

  • Target

    125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f.exe

  • Size

    1.2MB

  • Sample

    240831-be7a9awgjf

  • MD5

    c9ace572d2d553d19fa5e53d0d8c2b5b

  • SHA1

    875fed7dd2500de5a1be27de076b8e52560d4e45

  • SHA256

    125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f

  • SHA512

    66f4f0764c79a99f0dcd4efaa2fe9145bd2bbb5d85703dc28879677baa4988d17dd687b0b95721d09fd79bfee1565a34e24d7f22703cbc89da60191d989f0bbc

  • SSDEEP

    24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aTPjkJsIjf+LH1baC:mTvC/MTQYxsWR7aTbH11b

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.humatextiles.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    humatex786

Extracted

Family

vipkeylogger

Targets

    • Target

      125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f.exe

    • Size

      1.2MB

    • MD5

      c9ace572d2d553d19fa5e53d0d8c2b5b

    • SHA1

      875fed7dd2500de5a1be27de076b8e52560d4e45

    • SHA256

      125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f

    • SHA512

      66f4f0764c79a99f0dcd4efaa2fe9145bd2bbb5d85703dc28879677baa4988d17dd687b0b95721d09fd79bfee1565a34e24d7f22703cbc89da60191d989f0bbc

    • SSDEEP

      24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aTPjkJsIjf+LH1baC:mTvC/MTQYxsWR7aTbH11b

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks