General
-
Target
InvoiceStatementDocuments240927JK6789467TK.exe
-
Size
840KB
-
Sample
240928-fjh7faxhml
-
MD5
8903f7b4cd019765f5c9dea417c19e0c
-
SHA1
ebd086e3013c4911d94d0e95fb5032108d8e9dd9
-
SHA256
c653d5eaf07a938672078398ab0480572f09ae1e3202ced01eb6b12c94a670d7
-
SHA512
d97a2051b778c49a209d7ad65d4a72056f64291d12563397ac1a35f4eee6382a8837fdb59d41e688a51e3d15349f388ee1e7d675d6bdc4559d022e61e4304875
-
SSDEEP
24576:tthEVaPqLKTJ0kgkA/vgzw0yrNTou4DIOoX8:VEVUcCJnA/Iw0afTX8
Behavioral task
behavioral1
Sample
InvoiceStatementDocuments240927JK6789467TK.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
InvoiceStatementDocuments240927JK6789467TK.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.gmx.com - Port:
587 - Username:
[email protected] - Password:
Lowywett1947**1
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.gmx.com - Port:
587 - Username:
[email protected] - Password:
Lowywett1947**1 - Email To:
[email protected]
Targets
-
-
Target
InvoiceStatementDocuments240927JK6789467TK.exe
-
Size
840KB
-
MD5
8903f7b4cd019765f5c9dea417c19e0c
-
SHA1
ebd086e3013c4911d94d0e95fb5032108d8e9dd9
-
SHA256
c653d5eaf07a938672078398ab0480572f09ae1e3202ced01eb6b12c94a670d7
-
SHA512
d97a2051b778c49a209d7ad65d4a72056f64291d12563397ac1a35f4eee6382a8837fdb59d41e688a51e3d15349f388ee1e7d675d6bdc4559d022e61e4304875
-
SSDEEP
24576:tthEVaPqLKTJ0kgkA/vgzw0yrNTou4DIOoX8:VEVUcCJnA/Iw0afTX8
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-