General

  • Target

    013d183433171067d14d79fb2288fa94689963e60482da638800f23834710e19.exe

  • Size

    186KB

  • Sample

    241002-bc4scashka

  • MD5

    4c7c55280d405f6241f4c9f236fdea24

  • SHA1

    dfd1a0dce53f0a445ec6ad9f6d1266e96dec8f66

  • SHA256

    013d183433171067d14d79fb2288fa94689963e60482da638800f23834710e19

  • SHA512

    6cabc92097834307fb02f5687a19db6a93fe88f0c53cada037fe2f0eafb247ea7be249b460f53808a875c8febcf3460df235f8f4268370da92a11fb528dd0a10

  • SSDEEP

    3072:qh1KoemdZEhelYiU8aTTwmDOop3Q+Rt5IxMSke+mNOGW3emb4XBHTtOhu2qkWf3M:Doemd3lYiU5MmDOop3Q+RsxMSke+mNOW

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7371892501:AAE6c_q-yLsVj82ZZEmMuRlQtTm95MBjCz0/sendMessage?chat_id=6750192797

Targets

    • Target

      013d183433171067d14d79fb2288fa94689963e60482da638800f23834710e19.exe

    • Size

      186KB

    • MD5

      4c7c55280d405f6241f4c9f236fdea24

    • SHA1

      dfd1a0dce53f0a445ec6ad9f6d1266e96dec8f66

    • SHA256

      013d183433171067d14d79fb2288fa94689963e60482da638800f23834710e19

    • SHA512

      6cabc92097834307fb02f5687a19db6a93fe88f0c53cada037fe2f0eafb247ea7be249b460f53808a875c8febcf3460df235f8f4268370da92a11fb528dd0a10

    • SSDEEP

      3072:qh1KoemdZEhelYiU8aTTwmDOop3Q+Rt5IxMSke+mNOGW3emb4XBHTtOhu2qkWf3M:Doemd3lYiU5MmDOop3Q+RsxMSke+mNOW

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks