General

  • Target

    Fra_septiembre_CGM.rar

  • Size

    666KB

  • Sample

    241004-jsnp3awgrh

  • MD5

    a13ce859ac80c8d3b26a61a765ab6fc9

  • SHA1

    35b200880eeea2ff3758ea8eb63b299cdf2fc19c

  • SHA256

    b774b34bb4e9aeb33bdfaaee232aaf17ebf666aa642056eac78c11d4ea43937d

  • SHA512

    4fd400fec3cd0d32dc34b1a2c58e74c41e0c7a85aec291c03782a04ce573334bafdfe9774a6e9e656aa45fef6b9cb83d9c3b6cb8612ccfa123a0e985a5fae04a

  • SSDEEP

    12288:EM0jDiMr5UFQFVzkBRK5Oqen1l0V/Ev32KownlwzI2jV+OcDOeMqZsMpNur:yjDiIa2VAzK5OHaV/EeVwlmIocBVOMpG

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.pymetal.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    21hnosgomezrecambios2021

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      WIpGif4IRrFfamQ.exe

    • Size

      751KB

    • MD5

      102c9ce1c659517c4ea924c2044305b7

    • SHA1

      942b0a7e2077eca38b9b6ff16d89722cbbbf7002

    • SHA256

      b31cbc6ec2eb2b790c422f0f960bb1436106d92958703cb005ccdef38887e310

    • SHA512

      eca6ed6a871e9fbee67feb73534bff544f052d6b3e1058a68b4602f159f089193f0f576384e6cd49373d50200d71bb4aeadd151c0fb81a77a6246849af2f39f6

    • SSDEEP

      12288:L3TmP4kyFSnIZgc1D7COp2JwlmsxS4kZHtfi390V+KA7rC7LOmDZ:2gBOI9D7CO0JqTSRNfiQsG7LOmD

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks