General

  • Target

    InvoiceStatementDocuments240927JK6789467TK.exe

  • Size

    840KB

  • Sample

    240928-fjh7faxhml

  • MD5

    8903f7b4cd019765f5c9dea417c19e0c

  • SHA1

    ebd086e3013c4911d94d0e95fb5032108d8e9dd9

  • SHA256

    c653d5eaf07a938672078398ab0480572f09ae1e3202ced01eb6b12c94a670d7

  • SHA512

    d97a2051b778c49a209d7ad65d4a72056f64291d12563397ac1a35f4eee6382a8837fdb59d41e688a51e3d15349f388ee1e7d675d6bdc4559d022e61e4304875

  • SSDEEP

    24576:tthEVaPqLKTJ0kgkA/vgzw0yrNTou4DIOoX8:VEVUcCJnA/Iw0afTX8

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.gmx.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Lowywett1947**1

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      InvoiceStatementDocuments240927JK6789467TK.exe

    • Size

      840KB

    • MD5

      8903f7b4cd019765f5c9dea417c19e0c

    • SHA1

      ebd086e3013c4911d94d0e95fb5032108d8e9dd9

    • SHA256

      c653d5eaf07a938672078398ab0480572f09ae1e3202ced01eb6b12c94a670d7

    • SHA512

      d97a2051b778c49a209d7ad65d4a72056f64291d12563397ac1a35f4eee6382a8837fdb59d41e688a51e3d15349f388ee1e7d675d6bdc4559d022e61e4304875

    • SSDEEP

      24576:tthEVaPqLKTJ0kgkA/vgzw0yrNTou4DIOoX8:VEVUcCJnA/Iw0afTX8

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks