Behavioral task
behavioral1
Sample
fe777d4ff348afb74ba7556da56b29a4ee0a66f7b044674fd1f18641573337f2N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe777d4ff348afb74ba7556da56b29a4ee0a66f7b044674fd1f18641573337f2N.exe
Resource
win10v2004-20240802-en
General
-
Target
fe777d4ff348afb74ba7556da56b29a4ee0a66f7b044674fd1f18641573337f2N
-
Size
270KB
-
MD5
9c7cf85d2fa1d9c0b6c591b94cbf2830
-
SHA1
55822a8ed3ceda0fc325d998af2e379fb05a948e
-
SHA256
fe777d4ff348afb74ba7556da56b29a4ee0a66f7b044674fd1f18641573337f2
-
SHA512
813817015ddeec9e3bab1e1a945cecb942f75250fc2ea0de89de28c604e69d204d2a0217d4fa6be0d09bb662fddd2a17849a3989eb5a11bdd4b087ffddffb15f
-
SSDEEP
3072:8WAT5ctg+Orw0aqqb5mlXYOE6jc7dz0pHuhdzm3bfS2z/LQunsoAUYTVg4iIbbY:v6sm3bg7b
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.electradubai.com - Port:
25 - Username:
[email protected] - Password:
LordHaveMercy!!123 - Email To:
[email protected]
Signatures
-
Vipkeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe777d4ff348afb74ba7556da56b29a4ee0a66f7b044674fd1f18641573337f2N
Files
-
fe777d4ff348afb74ba7556da56b29a4ee0a66f7b044674fd1f18641573337f2N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ