General

  • Target

    dekont_20240918_38847738373.exe

  • Size

    891KB

  • Sample

    240924-ldmwbsseqf

  • MD5

    eb2e7ee3bebc073a9f5af99471542759

  • SHA1

    ee317898e36ec70f53fffd29f0d8fff4bb869276

  • SHA256

    a17f56e4377111d16e5d5387fb493c21625783d3ca52606c4b6d395123c75f54

  • SHA512

    2262ce340093565fe0b0e9a3a503f8f11ca9741ac608af8ea67f731747df3e5d1281dfa683c2ffdc6bc7eadff20aefd7fc62f759580177bfadfd05be9c4f82a5

  • SSDEEP

    12288:le0ceZ6Pz30pPXPwqpF1p07yU05CMMqr1ud2hsWPv2wbPGi1e:DcCpP/wqpF1p07305Car17+WPNbei1e

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.hattusakazdaglari.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    142536Dv+-

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      dekont_20240918_38847738373.exe

    • Size

      891KB

    • MD5

      eb2e7ee3bebc073a9f5af99471542759

    • SHA1

      ee317898e36ec70f53fffd29f0d8fff4bb869276

    • SHA256

      a17f56e4377111d16e5d5387fb493c21625783d3ca52606c4b6d395123c75f54

    • SHA512

      2262ce340093565fe0b0e9a3a503f8f11ca9741ac608af8ea67f731747df3e5d1281dfa683c2ffdc6bc7eadff20aefd7fc62f759580177bfadfd05be9c4f82a5

    • SSDEEP

      12288:le0ceZ6Pz30pPXPwqpF1p07yU05CMMqr1ud2hsWPv2wbPGi1e:DcCpP/wqpF1p07305Car17+WPNbei1e

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks