vipkeylogger | 1448-27-0x0000000000400000-0x0000000000448000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1448-27-0x0000000000400000-0x0000000000448000-memory.dmp
Size

288KB
MD5

b4e8edfaaaaffd99fc251247f5ca54ea
SHA1

9cae9fa637d7fd95321864c8bcc36331f409f3e3
SHA256

929d10b1a7895af01779e0fb0f3f5c3c0c7b61981a69f6d7bab06fbd774aac66
SHA512

c4aa2e548a3d5a06f87b012b19b8e36b9fe55bbdb4939f290f19222f4d1fe66601c7a42b8369bdfad18e6793a1eae605c5d59dfc1c6f90ef39f4434a19dded87
SSDEEP

3072:JXRVk7mtPLlHLOBv0pXNibtJUEr2SLK4U10dKQnVb2QfDs03ZY/Vgai:h42Vy1nVb2S

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
hosting2.ro.hostsailor.com
Port:
587
Username:
[email protected]
Password:
7213575aceACE@@
Email To:
[email protected]

Signatures

Vipkeylogger family
vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1448-27-0x0000000000400000-0x0000000000448000-memory.dmp

Files

1448-27-0x0000000000400000-0x0000000000448000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ