vipkeylogger

General

Target

27102024_1408_18102024_RFQ-KTE-07102024.pdf.z
Size

12KB
Sample

241027-rfqb5awmfz
MD5

7d39771ed7ef496f1b8410acdee4099d
SHA1

0baa2cc2f1e1e322d09057c8b092873c028e24dd
SHA256

ab160f7ae2bfabef17e26479c88320d6e0dc237328ec3d1586a1f6d9eb234684
SHA512

bd1325a50dba9fd5b319d5b8699fa932492ba3d1427699fadc43c23c1e44ac947969beed2905e77d96cb35bfea1b5963f4a7ba734f6c4078452033cd5c26f586
SSDEEP

384:jzUalKK1CPIHvae6Txr6r9Vaws5vWMxbSP7mKX44:jzllKMHSe6dG6+MomKH

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7371892501:AAE6c_q-yLsVj82ZZEmMuRlQtTm95MBjCz0/sendMessage?chat_id=6750192797

Targets

- Target
  
  RFQ-KTE-07102024.pdf.scr
- Size
  
  28KB
- MD5
  
  4aab71fbea4b35729e6a1de62c3e9c4d
- SHA1
  
  2b4bc1a883fa32a13b095a6385ca54f2a61a1959
- SHA256
  
  81902ac66a51c109471bf723cd373ab47a52c992855b9e2dd954090326cac420
- SHA512
  
  1eadfc55728d115244ada96a7eb4de174afc34333bad63ec72d0e9f478f07c1c536e91319c1b9bcc7ea0e0a09d5130e21acf8ab5ba5b1fbd1f8441649bd2f660
- SSDEEP
  
  384:UHcq28V683SxRkjkpvPDFBpzg3GBqphxAwRfsSlYoxEcn1k6+IGJl:UV3SxKjOHDZ83GBv2xr1k6+ISl
Score

10^/10

discovery vipkeylogger collection keylogger stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Vipkeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2