General

  • Target

    1c829d80809fb2b5f7c2b40cf05064765bf237f655c9ca557e2d5a01f52b4bc6.exe

  • Size

    678KB

  • Sample

    240926-bkdwws1fkc

  • MD5

    48977f1b641a9a3d88329ac470152381

  • SHA1

    d0eb9734f9bdeb6ab50ccad4342f92f4d405d2f0

  • SHA256

    1c829d80809fb2b5f7c2b40cf05064765bf237f655c9ca557e2d5a01f52b4bc6

  • SHA512

    8f0e68b0b489a5aeb363641dc85408e8358a2fbd822d62cf494ce670294fe8f84d8c0ae2baa6e80c3099b3e37a8b35501b87eac88235e52c935908a0d565975b

  • SSDEEP

    12288:QkJZPIBQBNWZEV6fewCe5wHdiFNCghayBN9YlXOx5eh8bQb:Q5iNiEVkAe5wMFNChly5BI

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      1c829d80809fb2b5f7c2b40cf05064765bf237f655c9ca557e2d5a01f52b4bc6.exe

    • Size

      678KB

    • MD5

      48977f1b641a9a3d88329ac470152381

    • SHA1

      d0eb9734f9bdeb6ab50ccad4342f92f4d405d2f0

    • SHA256

      1c829d80809fb2b5f7c2b40cf05064765bf237f655c9ca557e2d5a01f52b4bc6

    • SHA512

      8f0e68b0b489a5aeb363641dc85408e8358a2fbd822d62cf494ce670294fe8f84d8c0ae2baa6e80c3099b3e37a8b35501b87eac88235e52c935908a0d565975b

    • SSDEEP

      12288:QkJZPIBQBNWZEV6fewCe5wHdiFNCghayBN9YlXOx5eh8bQb:Q5iNiEVkAe5wMFNChly5BI

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks