General

  • Target

    7vbu8ZW8lFI8mn5.exe

  • Size

    730KB

  • Sample

    241022-qceksawepf

  • MD5

    07188bef748562cde18f2b77f76bae94

  • SHA1

    70f3fddd3fb0030e4e7422a41d560374c463e1dc

  • SHA256

    2a53872f573a1817be1848779e60c7db22501badc0afd7f364ee30a77dce3395

  • SHA512

    fab75b7746af8b04bda1361737d47e33bb770be79872830722bf4affe2231d222c01032f73f48d92268027a20e0eb230c7c8ff3a94b6813b2ce4dd445e6ddf94

  • SSDEEP

    12288:EYkhMOoltiJE75jOnBtT/6YDr33baequP3y5Mg1YHJGtG3r8Ru4ZiOQkx:EYkh5oDiJftTDzagPfg2pGtQr87Zr

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      7vbu8ZW8lFI8mn5.exe

    • Size

      730KB

    • MD5

      07188bef748562cde18f2b77f76bae94

    • SHA1

      70f3fddd3fb0030e4e7422a41d560374c463e1dc

    • SHA256

      2a53872f573a1817be1848779e60c7db22501badc0afd7f364ee30a77dce3395

    • SHA512

      fab75b7746af8b04bda1361737d47e33bb770be79872830722bf4affe2231d222c01032f73f48d92268027a20e0eb230c7c8ff3a94b6813b2ce4dd445e6ddf94

    • SSDEEP

      12288:EYkhMOoltiJE75jOnBtT/6YDr33baequP3y5Mg1YHJGtG3r8Ru4ZiOQkx:EYkh5oDiJftTDzagPfg2pGtQr87Zr

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks