General
-
Target
HeCSSJMQufSsHnr.exe_
-
Size
721KB
-
Sample
240903-npmqtavgqr
-
MD5
b33393f527b3cf8556bff9cd0440a945
-
SHA1
39d089d3fb0aad344dd4a7365b47a4652822eb2d
-
SHA256
7812b5b375ff359c2b1eec78d4b1917a137482c2f2eff92f9d95562965487551
-
SHA512
baac43d4e3c50df8fcc94cb3b051762e0e74fae6b978f8ef79354f1a34606452f39c19c6d6c8bb715762d4919d775b8d452103f14ab76724656c2392cb172207
-
SSDEEP
12288:JrBKYvI8d0NlM20dPVJYdWf7CX+utnQ7quCmYoMo381ByZkv6JrkR:pOYAO20dTuXxnQ7qu6No3kByZkCc
Static task
static1
Behavioral task
behavioral1
Sample
HeCSSJMQufSsHnr.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HeCSSJMQufSsHnr.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
195.54.163.133 - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@ - Email To:
[email protected]
Targets
-
-
Target
HeCSSJMQufSsHnr.exe_
-
Size
721KB
-
MD5
b33393f527b3cf8556bff9cd0440a945
-
SHA1
39d089d3fb0aad344dd4a7365b47a4652822eb2d
-
SHA256
7812b5b375ff359c2b1eec78d4b1917a137482c2f2eff92f9d95562965487551
-
SHA512
baac43d4e3c50df8fcc94cb3b051762e0e74fae6b978f8ef79354f1a34606452f39c19c6d6c8bb715762d4919d775b8d452103f14ab76724656c2392cb172207
-
SSDEEP
12288:JrBKYvI8d0NlM20dPVJYdWf7CX+utnQ7quCmYoMo381ByZkv6JrkR:pOYAO20dTuXxnQ7qu6No3kByZkCc
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2