Behavioral task
behavioral1
Sample
2604-18-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2604-18-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2604-18-0x0000000000400000-0x0000000000448000-memory.dmp
-
Size
288KB
-
MD5
ecd4187b8fde6a2941f9337ea0d732fc
-
SHA1
b8d16a9e387f71ff25d5df09afa40ebaf2ccd90d
-
SHA256
7ee88b92d37a8fe47e1ab3bdb289de6e324520d10203fbeafe5a39574721ecc8
-
SHA512
1092827a1a1f94b3aaf4789718b6dd2cd3a1c3d42e763a185d1a6b8e9e39b88812e952e0ae2dbd41b7903a165f2c3d835fe144edda0b4c2cc0218cbd7e59bfbe
-
SSDEEP
3072:rA+blXHC7k7WZuXRAnxXFrXIV+gEN4PSL66U10dKQnVb2QfDs0xZY/Vgai/bbY:eQWrZ4P3y1nVb2kdb
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
185.198.59.26 - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@@ - Email To:
[email protected]
Signatures
-
Vipkeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2604-18-0x0000000000400000-0x0000000000448000-memory.dmp
Files
-
2604-18-0x0000000000400000-0x0000000000448000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 262KB - Virtual size: 262KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ