General
-
Target
02092024_1411_02092024_PI_PAOO8368.zip
-
Size
378KB
-
Sample
240902-rhqqnsshkf
-
MD5
3eb492d50988a1e7c5ad94add44310b0
-
SHA1
a50fea5a22683f6a81773986d1584678e3f93e60
-
SHA256
6d38e89e502363315b2520c21841a62574fa25a825b957fe082a7c2f6f286300
-
SHA512
66a2c8e8e7e32dfb419a669ca6b068e7bc7fd7ea686f3925ce1ec2dfa844d085457a612f4007d8b0209b6a4c4dc516ba01b2e5d4bf66f8766e5414bd86016f11
-
SSDEEP
6144:AsE1Hid9GwWd7LEYJS90GHxOfWRUDwqftiQr8ZLW4WgZ3kmvDyEEyw5TICs:KdI0GHxOfxt981WWkEEyC3s
Static task
static1
Behavioral task
behavioral1
Sample
PI_PAOO8368.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PI_PAOO8368.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7241860669:AAHzsiJgjEuzq3bEu2HRcWsWDZUpEeVOKSA/sendMessage?chat_id=5780514555
Targets
-
-
Target
PI_PAOO8368.cmd
-
Size
623KB
-
MD5
2f77a6b8df7703193154ed636b3985d3
-
SHA1
8565f181cfb088268b27a355d8f4277a0f7b8e2b
-
SHA256
23d1a139f79b2b7c5e09725333cd5a254aedd9192a735b68b379fd2c7509e388
-
SHA512
7475c64997fc861ed5d532cc72612af948c2db0d7417dcde8717909bf0a1bc6681ae6cd58f6725ba561a31db187cefd9f9a103e692a882b56d69b65cf8b28132
-
SSDEEP
12288:58G1KBscH8IPUYaJvPnq2P9zOxRdNeq6ylf4QAVlD7xrjZovH5UPy:ZYBXcJBvq2PoxRdNeq6AQQytVXZs5U6
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-