General
-
Target
C0R558474T219551638.eml
-
Size
536KB
-
Sample
240902-qwed5a1emm
-
MD5
e98ea39181880b0c41abb9ec0c3e70cc
-
SHA1
87a04d54e8ad26fc265ff47caee65815f6435590
-
SHA256
4d60065ef97b8f8d215e6dec8e3c279b38c93494bde6471ee1dcccdfc6c74d27
-
SHA512
fec473b47a0c59e9122d436704fd7a965c7e57789558fae0da95c26fdb3f5a0c4d1bb112dc3b35be475c0008904bb33b4b6fc715a31c440fc780329703f99200
-
SSDEEP
12288:J8Vpfk3wOtdxJoFhApfHAU30StlP0I89fQwrHkdu5mTg2KoIB4SGaAU:Wix1WhaHAUkStEZrHhRNB4SGaAU
Static task
static1
Behavioral task
behavioral1
Sample
PI_PAOO8368.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PI_PAOO8368.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7241860669:AAHzsiJgjEuzq3bEu2HRcWsWDZUpEeVOKSA/sendMessage?chat_id=5780514555
Targets
-
-
Target
PI_PAOO8368.cmd
-
Size
623KB
-
MD5
2f77a6b8df7703193154ed636b3985d3
-
SHA1
8565f181cfb088268b27a355d8f4277a0f7b8e2b
-
SHA256
23d1a139f79b2b7c5e09725333cd5a254aedd9192a735b68b379fd2c7509e388
-
SHA512
7475c64997fc861ed5d532cc72612af948c2db0d7417dcde8717909bf0a1bc6681ae6cd58f6725ba561a31db187cefd9f9a103e692a882b56d69b65cf8b28132
-
SSDEEP
12288:58G1KBscH8IPUYaJvPnq2P9zOxRdNeq6ylf4QAVlD7xrjZovH5UPy:ZYBXcJBvq2PoxRdNeq6AQQytVXZs5U6
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-