Overview

overview

10

Static

static

5

Updated Au...DF.exe

windows7-x64

10

Updated Au...DF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4.r00
  • Size 537KB
  • Sample240927-spccas1dpa
  • SHA256 bddf6abc37e6b822d549332852480f0a51dc236cb7986d62770c317a4fac6a13
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

  • vipkeylogger

C2

  • https://api.telegram.org/bot7641394138:AAHF_l3_1VbXDQgEgBWtKiS_hhwS62n9ylA/sendMessage?chat_id=5780514555

Targets

    • Target
      Updated August SOA 218938_PDF.exe
    • Size 1.0MB
    • SHA256 1c15fd2833a87ac08abe439ef3e5d25d72d26384bb7b2f37f8a121791f2849eb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks