General

  • Target

    02092024_1411_02092024_PI_PAOO8368.zip

  • Size

    378KB

  • Sample

    240902-rhqqnsshkf

  • MD5

    3eb492d50988a1e7c5ad94add44310b0

  • SHA1

    a50fea5a22683f6a81773986d1584678e3f93e60

  • SHA256

    6d38e89e502363315b2520c21841a62574fa25a825b957fe082a7c2f6f286300

  • SHA512

    66a2c8e8e7e32dfb419a669ca6b068e7bc7fd7ea686f3925ce1ec2dfa844d085457a612f4007d8b0209b6a4c4dc516ba01b2e5d4bf66f8766e5414bd86016f11

  • SSDEEP

    6144:AsE1Hid9GwWd7LEYJS90GHxOfWRUDwqftiQr8ZLW4WgZ3kmvDyEEyw5TICs:KdI0GHxOfxt981WWkEEyC3s

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7241860669:AAHzsiJgjEuzq3bEu2HRcWsWDZUpEeVOKSA/sendMessage?chat_id=5780514555

Targets

    • Target

      PI_PAOO8368.cmd

    • Size

      623KB

    • MD5

      2f77a6b8df7703193154ed636b3985d3

    • SHA1

      8565f181cfb088268b27a355d8f4277a0f7b8e2b

    • SHA256

      23d1a139f79b2b7c5e09725333cd5a254aedd9192a735b68b379fd2c7509e388

    • SHA512

      7475c64997fc861ed5d532cc72612af948c2db0d7417dcde8717909bf0a1bc6681ae6cd58f6725ba561a31db187cefd9f9a103e692a882b56d69b65cf8b28132

    • SSDEEP

      12288:58G1KBscH8IPUYaJvPnq2P9zOxRdNeq6ylf4QAVlD7xrjZovH5UPy:ZYBXcJBvq2PoxRdNeq6AQQytVXZs5U6

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks