General

  • Target

    INVOICE-COAU7230734290.pdf.exe

  • Size

    918KB

  • Sample

    241005-rl6w3azaph

  • MD5

    5bb3016066f72de5f65de1345ed0b8ba

  • SHA1

    1bdb6c41b9a14fc7091e4319f61c3dc0e369ab05

  • SHA256

    01ab4d20ae687b065b10fdf3f3243a46a320dcec4b3a9a8e0cafcc0878aa1800

  • SHA512

    7209b53ef8852fa51961372c74679e67d2ca100ee23e7cd017603d8218a77983c0333efd5bfe9b761076f1b2b0acba9fb8f13879ac00be4a21b000de6e34022b

  • SSDEEP

    24576:UvxcYHhaEOLiNF92FCbdWHE2IYRqT4jBiQ4T:Up+WNF9wCbdWH9qc4Q4T

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      INVOICE-COAU7230734290.pdf.exe

    • Size

      918KB

    • MD5

      5bb3016066f72de5f65de1345ed0b8ba

    • SHA1

      1bdb6c41b9a14fc7091e4319f61c3dc0e369ab05

    • SHA256

      01ab4d20ae687b065b10fdf3f3243a46a320dcec4b3a9a8e0cafcc0878aa1800

    • SHA512

      7209b53ef8852fa51961372c74679e67d2ca100ee23e7cd017603d8218a77983c0333efd5bfe9b761076f1b2b0acba9fb8f13879ac00be4a21b000de6e34022b

    • SSDEEP

      24576:UvxcYHhaEOLiNF92FCbdWHE2IYRqT4jBiQ4T:Up+WNF9wCbdWH9qc4Q4T

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks