General

  • Target

    Swift Detail 103.exe

  • Size

    1.2MB

  • Sample

    241022-qv8lkszbkq

  • MD5

    f88a322c14893a6cbce0ed1bc6540eae

  • SHA1

    367bccd84a786d4a373a36a3741159c77723b25b

  • SHA256

    8d3f2503bf26b36de8de3ebaef4f3bcbea79c43c56ec4827d7944acdb8eec11c

  • SHA512

    07c6c7f66cfe0e266e9f50b32b22c490738d060d5ac537aeae5ccdd69c87b02fd1d1b653c8dcaedbca4aa8472550a51310d7e574277531028d1ff62355c12878

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLWBv9U8rPu7I64VPcIzh:f3v+7/5QLWBlUqWIBPh

Malware Config

Extracted

Family

vipkeylogger

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.starofseasmarine.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Dontforget2015

Targets

    • Target

      Swift Detail 103.exe

    • Size

      1.2MB

    • MD5

      f88a322c14893a6cbce0ed1bc6540eae

    • SHA1

      367bccd84a786d4a373a36a3741159c77723b25b

    • SHA256

      8d3f2503bf26b36de8de3ebaef4f3bcbea79c43c56ec4827d7944acdb8eec11c

    • SHA512

      07c6c7f66cfe0e266e9f50b32b22c490738d060d5ac537aeae5ccdd69c87b02fd1d1b653c8dcaedbca4aa8472550a51310d7e574277531028d1ff62355c12878

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLWBv9U8rPu7I64VPcIzh:f3v+7/5QLWBlUqWIBPh

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks