General
-
Target
125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f.exe
-
Size
1.2MB
-
Sample
240831-be7a9awgjf
-
MD5
c9ace572d2d553d19fa5e53d0d8c2b5b
-
SHA1
875fed7dd2500de5a1be27de076b8e52560d4e45
-
SHA256
125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f
-
SHA512
66f4f0764c79a99f0dcd4efaa2fe9145bd2bbb5d85703dc28879677baa4988d17dd687b0b95721d09fd79bfee1565a34e24d7f22703cbc89da60191d989f0bbc
-
SSDEEP
24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aTPjkJsIjf+LH1baC:mTvC/MTQYxsWR7aTbH11b
Static task
static1
Behavioral task
behavioral1
Sample
125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.humatextiles.com - Port:
587 - Username:
[email protected] - Password:
humatex786
Extracted
vipkeylogger
Targets
-
-
Target
125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f.exe
-
Size
1.2MB
-
MD5
c9ace572d2d553d19fa5e53d0d8c2b5b
-
SHA1
875fed7dd2500de5a1be27de076b8e52560d4e45
-
SHA256
125feebfb2a0a40dabe47bc79cabfc93c575e7a670890ba2aab42f2743ea532f
-
SHA512
66f4f0764c79a99f0dcd4efaa2fe9145bd2bbb5d85703dc28879677baa4988d17dd687b0b95721d09fd79bfee1565a34e24d7f22703cbc89da60191d989f0bbc
-
SSDEEP
24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aTPjkJsIjf+LH1baC:mTvC/MTQYxsWR7aTbH11b
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-