vipkeylogger | 2716-87-0x0000000001090000-0x00000000010D8000-memory[.]dmp | Triage

Sharing

General

Target

2716-87-0x0000000001090000-0x00000000010D8000-memory.dmp
Size

288KB
MD5

43539072f742dd35a4a5df99005841db
SHA1

a091a07ae31c2c1277b5ecd237c31334c59796d7
SHA256

82bf7c36e0c4e69ccf32b3541284bec2062a3c633f72dbf5a23f92dff9ba5726
SHA512

8fac0aa6d5f6dc4cdc870bdfe23f12202b74519184048de2254ead325c1d850e033701409248fac5bdba604de6bcb77b0f14e41111a943863aa8b7b112499d7b
SSDEEP

3072:P22TjoN+4xwZZWZAy1MXmiwIipGV7wa7rpHuBjf+ibfksJ2s0uXYTVgHi8bbY:dwa7rojf+ibFJ1Pb

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.inmogomar.com
Port:
587
Username:
[email protected]
Password:
Gomar-19600
Email To:
[email protected]

Signatures

Vipkeylogger family
vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2716-87-0x0000000001090000-0x00000000010D8000-memory.dmp

Files

2716-87-0x0000000001090000-0x00000000010D8000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ