General

  • Target

    956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9.exe

  • Size

    6KB

  • Sample

    241022-b4dp8szapc

  • MD5

    c3faec92c8d98520e0cdab9ba05d1a3f

  • SHA1

    39a025bf0c0f94a0a269e72700a9f0245a349b36

  • SHA256

    956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9

  • SHA512

    183ecac23b10da4bc48cacef135fbc647796b2764804f43f91b5a49b09a0a535d23700afa7d469a816b94206858513c9d0c08fc46eab3075f21b1ea6e12d3dd3

  • SSDEEP

    96:LQAm7EhsIHRpY5J2jRZ4ph5CkN/jo4zNt:cAm7lIxEmRZOh5hp

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7371892501:AAE6c_q-yLsVj82ZZEmMuRlQtTm95MBjCz0/sendMessage?chat_id=6750192797

Targets

    • Target

      956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9.exe

    • Size

      6KB

    • MD5

      c3faec92c8d98520e0cdab9ba05d1a3f

    • SHA1

      39a025bf0c0f94a0a269e72700a9f0245a349b36

    • SHA256

      956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9

    • SHA512

      183ecac23b10da4bc48cacef135fbc647796b2764804f43f91b5a49b09a0a535d23700afa7d469a816b94206858513c9d0c08fc46eab3075f21b1ea6e12d3dd3

    • SSDEEP

      96:LQAm7EhsIHRpY5J2jRZ4ph5CkN/jo4zNt:cAm7lIxEmRZOh5hp

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks