General
-
Target
956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9.exe
-
Size
6KB
-
Sample
241022-b4dp8szapc
-
MD5
c3faec92c8d98520e0cdab9ba05d1a3f
-
SHA1
39a025bf0c0f94a0a269e72700a9f0245a349b36
-
SHA256
956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9
-
SHA512
183ecac23b10da4bc48cacef135fbc647796b2764804f43f91b5a49b09a0a535d23700afa7d469a816b94206858513c9d0c08fc46eab3075f21b1ea6e12d3dd3
-
SSDEEP
96:LQAm7EhsIHRpY5J2jRZ4ph5CkN/jo4zNt:cAm7lIxEmRZOh5hp
Static task
static1
Behavioral task
behavioral1
Sample
956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7371892501:AAE6c_q-yLsVj82ZZEmMuRlQtTm95MBjCz0/sendMessage?chat_id=6750192797
Targets
-
-
Target
956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9.exe
-
Size
6KB
-
MD5
c3faec92c8d98520e0cdab9ba05d1a3f
-
SHA1
39a025bf0c0f94a0a269e72700a9f0245a349b36
-
SHA256
956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9
-
SHA512
183ecac23b10da4bc48cacef135fbc647796b2764804f43f91b5a49b09a0a535d23700afa7d469a816b94206858513c9d0c08fc46eab3075f21b1ea6e12d3dd3
-
SSDEEP
96:LQAm7EhsIHRpY5J2jRZ4ph5CkN/jo4zNt:cAm7lIxEmRZOh5hp
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-