vipkeylogger | 2112-34-0x0000000000480000-0x00000000004C8000-memory[.]dmp

General

Target
2112-34-0x0000000000480000-0x00000000004C8000-memory.dmp
Size 288KB
Sample241027-el2k5a1mar
SHA256 53d6f834902d4eec04598d77fccf2229c7cf6f460817ea7216779480546bb71b
MD5 e3a63b24ab67c9e61d253c85f8a3324e
SHA1 c52f02b486fd97c8e64a97676166bc52b4a0e992
SHA512 5ade496176dad6364183f403d849b00186f11f2383b802d2d29cf9137a27cbb9d5d1225e88cb3ab8587b63de1960c946f8c636bc8f757c6ecf2f486073ecb39f
SSDEEP 6144:tK0jMsk4ciMA4W+hlEyUaq+YaeQB99PvPdHDYvCA02Xb+YZb:tK0jMsk4ciMA4W+hlEyUaq+YaeQB99Pc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7511877228:AAEfdtsXiYLhmN4YbL4GOCHPaqlvykB-alc/sendMessage?chat_id=7534008929

Signatures

Vipkeylogger family
vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2112-34-0x0000000000480000-0x00000000004C8000-memory.dmp

File Explorer

2112-34-0x0000000000480000-0x00000000004C8000-memory.dmp

.exe 288KB

2112-34-0x0000000000480000-0x00000000004C8000-memory.dmp

SHA256 53d6f834902d4eec04598d77fccf2229c7cf6f460817ea7216779480546bb71b
MD5 e3a63b24ab67c9e61d253c85f8a3324e
SHA1 c52f02b486fd97c8e64a97676166bc52b4a0e992
SHA512 5ade496176dad6364183f403d849b00186f11f2383b802d2d29cf9137a27cbb9d5d1225e88cb3ab8587b63de1960c946f8c636bc8f757c6ecf2f486073ecb39f
SSDEEP 6144:tK0jMsk4ciMA4W+hlEyUaq+YaeQB99PvPdHDYvCA02Xb+YZb:tK0jMsk4ciMA4W+hlEyUaq+YaeQB99Pc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

277518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing