General

  • Target

    173090160965f4af6053e0cc550b1580793735ec4c6bd2a63005d1f358aeab4a3375f6790f876.dat-decoded.exe

  • Size

    202KB

  • Sample

    241106-rbjnsa1fja

  • MD5

    3e049689acb4cbecc9f0499e3837f170

  • SHA1

    b584754b3f15913a36430df63624032790a0c988

  • SHA256

    80ab90c8f1fce911c9094718b3a455aa8ea2b4006520f4c311edea9aaffb7fd4

  • SHA512

    4baa8ae8b5d97beb8db20b7907edeeada16fda1d6bb17792151db063aad5a064ab9f24baf4efb0a55fd89a92e3edcdc3edf60d7b9c6dc0f84a567a9e73cc169e

  • SSDEEP

    3072:gDKW1LgppLRHMY0TBfJvjcTp5XHqv52mQYC0DKttAZaGB7AFRo7bYE:gDKW1Lgbdl0TBBvjc/O2mDaDI0Lybn

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      173090160965f4af6053e0cc550b1580793735ec4c6bd2a63005d1f358aeab4a3375f6790f876.dat-decoded.exe

    • Size

      202KB

    • MD5

      3e049689acb4cbecc9f0499e3837f170

    • SHA1

      b584754b3f15913a36430df63624032790a0c988

    • SHA256

      80ab90c8f1fce911c9094718b3a455aa8ea2b4006520f4c311edea9aaffb7fd4

    • SHA512

      4baa8ae8b5d97beb8db20b7907edeeada16fda1d6bb17792151db063aad5a064ab9f24baf4efb0a55fd89a92e3edcdc3edf60d7b9c6dc0f84a567a9e73cc169e

    • SSDEEP

      3072:gDKW1LgppLRHMY0TBfJvjcTp5XHqv52mQYC0DKttAZaGB7AFRo7bYE:gDKW1Lgbdl0TBBvjc/O2mDaDI0Lybn

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks