General

  • Target

    a50064c55d2ad5a1e6f6aa7a5841ee0b8547285a7d35a997ccc4c0ad01d7b9ea

  • Size

    673KB

  • Sample

    241001-njat3awhpn

  • MD5

    ecfe433c62091a7dc32a59f5426bbdfa

  • SHA1

    8f5bc1501e095dc36c2a7574b7718f62bdf88571

  • SHA256

    a50064c55d2ad5a1e6f6aa7a5841ee0b8547285a7d35a997ccc4c0ad01d7b9ea

  • SHA512

    a1d6a5f1189680270c7e68b297549b3687a821f7d0648fbfe4812b561c648905d2799235ff4eb7fbaf5148e861c6c7f10f9aa95f72e16186bf8aa76064eef33e

  • SSDEEP

    12288:pF8tfAqsLtXxRu5AFL1DPNxsyXHaf41K0RJqakc8xaWoNvt+M4V19y:f8tfYQcbW26AEvX2WoN1+h1g

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    foxwagon-equipment.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    SVBd8Gv^}!B1

Targets

    • Target

      invoices.exe

    • Size

      757KB

    • MD5

      fbe6bc03a03310d3cb73b56f26c450c4

    • SHA1

      daef2bf82d629458f58ef53c2faf93970c27644e

    • SHA256

      1ffdb5b3f3b764b20dfc66d3c70d80d25a75b3707f42cce07b032398bce7b195

    • SHA512

      55972ac403bb20d4ff8f4da07c62c0172260f3e73889b4e5069ad999920409f30c7cbca95bb953ed0d10fe0af38555b816322bcfcea79fc75ea123b0471e5ad1

    • SSDEEP

      12288:HNit1Ay2Lr/xR65Qxh1D5N1IyXHu1/NeKtmtpqgqc5kp2PLitx+xRkR:At1yQUJW2OPbnlYLQx+xM

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks