General

  • Target

    8be1cbc061eefc174dc0ff4aa6af8f69b88aa6c642ccd98c36d4f720eb36db4c.exe

  • Size

    270KB

  • Sample

    241106-dk52gswmbp

  • MD5

    ddfa923fad828f710f1098684aa5afc0

  • SHA1

    7504ea8d286a32bb23c98cd197ca4e4c1967922f

  • SHA256

    8be1cbc061eefc174dc0ff4aa6af8f69b88aa6c642ccd98c36d4f720eb36db4c

  • SHA512

    f4351769e36a6fdb1a4564b0f23d4c895cfe844650b373f5bc44823d4c8d6737762f4086f28adebd21ac0d94bda66b7ad5707ade85547683b484b5d7dadfa085

  • SSDEEP

    3072:DicrbDkA33F3W5j/agPXQdwflU4uSL1CC2TRbIxso/UY/Vg4iKbbY:AuVTRbudb

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.singhalenterprise.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    balkishan@123

Targets

    • Target

      8be1cbc061eefc174dc0ff4aa6af8f69b88aa6c642ccd98c36d4f720eb36db4c.exe

    • Size

      270KB

    • MD5

      ddfa923fad828f710f1098684aa5afc0

    • SHA1

      7504ea8d286a32bb23c98cd197ca4e4c1967922f

    • SHA256

      8be1cbc061eefc174dc0ff4aa6af8f69b88aa6c642ccd98c36d4f720eb36db4c

    • SHA512

      f4351769e36a6fdb1a4564b0f23d4c895cfe844650b373f5bc44823d4c8d6737762f4086f28adebd21ac0d94bda66b7ad5707ade85547683b484b5d7dadfa085

    • SSDEEP

      3072:DicrbDkA33F3W5j/agPXQdwflU4uSL1CC2TRbIxso/UY/Vg4iKbbY:AuVTRbudb

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks