General
-
Target
Pedido de Cotação -RFQ20241029_Pdf.vbs
-
Size
344KB
-
Sample
241030-g5g2yayamb
-
MD5
9654b19bdda7ce4856861e8e46c17ccf
-
SHA1
7d7dd29dacd5badbf45337998f8ba44faabafe31
-
SHA256
bccb0ccb0f6f7ed80d4f2a27053febad9fbf4aa00ce438cf52b629cd12d1e0d3
-
SHA512
5335c6087d4f6112446e61f8dedacf43c5168c824d43f5991479ed85a0f879a633051af2595b719dfaac7abb54f5a55291c380bbb1d0728aeae609781c64f53a
-
SSDEEP
6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcI7:ZgcgL8jD/wGmzcspqU0JuR
Static task
static1
Behavioral task
behavioral1
Sample
Pedido de Cotação -RFQ20241029_Pdf.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Pedido de Cotação -RFQ20241029_Pdf.vbs
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.recsb.com - Port:
587 - Username:
[email protected] - Password:
1=vI*r6^ - Email To:
[email protected]
Targets
-
-
Target
Pedido de Cotação -RFQ20241029_Pdf.vbs
-
Size
344KB
-
MD5
9654b19bdda7ce4856861e8e46c17ccf
-
SHA1
7d7dd29dacd5badbf45337998f8ba44faabafe31
-
SHA256
bccb0ccb0f6f7ed80d4f2a27053febad9fbf4aa00ce438cf52b629cd12d1e0d3
-
SHA512
5335c6087d4f6112446e61f8dedacf43c5168c824d43f5991479ed85a0f879a633051af2595b719dfaac7abb54f5a55291c380bbb1d0728aeae609781c64f53a
-
SSDEEP
6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcI7:ZgcgL8jD/wGmzcspqU0JuR
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-