General
-
Target
3140, EUR.exe
-
Size
796KB
-
Sample
240930-p9scgawgnr
-
MD5
332593ae1e0ba5a06370963c37bbbceb
-
SHA1
994f8e733ba1961882dcdef0c78fc305db4c1c91
-
SHA256
9ca5a71321522f47140b36e5f1983cff7455dd124caa231d97df29cd654c6893
-
SHA512
111b6d04597e4f00d8d30cb3e1c8514b92fc1ad936db7553a6f9f00146e0511bedb4d0fcd2cb011959063ffa6eac88a8287724ade1e67a1aa77122390c7e48c0
-
SSDEEP
12288:UUxLU3TBHWn/JDfaWEtYWWcw/1/4sln7aIK5nRYji9avo0Dx/v7UcM:UUxCHwDiWEepcw/ia7aV6jMG/HYcM
Static task
static1
Behavioral task
behavioral1
Sample
3140, EUR.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3140, EUR.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: ftp- Host:
quicklyserv.com - Port:
21 - Username:
[email protected] - Password:
omobolajijonze12345
Extracted
vipkeylogger
Targets
-
-
Target
3140, EUR.exe
-
Size
796KB
-
MD5
332593ae1e0ba5a06370963c37bbbceb
-
SHA1
994f8e733ba1961882dcdef0c78fc305db4c1c91
-
SHA256
9ca5a71321522f47140b36e5f1983cff7455dd124caa231d97df29cd654c6893
-
SHA512
111b6d04597e4f00d8d30cb3e1c8514b92fc1ad936db7553a6f9f00146e0511bedb4d0fcd2cb011959063ffa6eac88a8287724ade1e67a1aa77122390c7e48c0
-
SSDEEP
12288:UUxLU3TBHWn/JDfaWEtYWWcw/1/4sln7aIK5nRYji9avo0Dx/v7UcM:UUxCHwDiWEepcw/ia7aV6jMG/HYcM
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2