General

  • Target

    Unconfirmed 281249.crdownload

  • Size

    141KB

  • Sample

    241106-rjwcjsscjk

  • MD5

    d1da37e08ff5734b065e4fd3160db32c

  • SHA1

    0124fd6667b3e82cffb2bfcf9d908e957a44ed1a

  • SHA256

    c57183d86d1d4a472e044f7bd9f341d33a246deeabcce3f69fcd410046e69678

  • SHA512

    9feacc9f22b1717f4a4684ecfee9e36898c5cee17f9603db0627a3802d5ae0345b124c618c05bff6462b640fc20447f6691daad1cf9217cb7a5d31342a0fd150

  • SSDEEP

    3072:U3J9ffwlIDs6t/10s1MmRH3vXU+G4u9S1D9ZISD3UNdNp1i02L5uAkYa+f08MneI:U3Ts835D95gfp1i0Wuzb+fwL

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      80ab90c8f1fce911c9094718b3a455aa8ea2b4006520f4c311edea9aaffb7fd4.exe

    • Size

      202KB

    • MD5

      3e049689acb4cbecc9f0499e3837f170

    • SHA1

      b584754b3f15913a36430df63624032790a0c988

    • SHA256

      80ab90c8f1fce911c9094718b3a455aa8ea2b4006520f4c311edea9aaffb7fd4

    • SHA512

      4baa8ae8b5d97beb8db20b7907edeeada16fda1d6bb17792151db063aad5a064ab9f24baf4efb0a55fd89a92e3edcdc3edf60d7b9c6dc0f84a567a9e73cc169e

    • SSDEEP

      3072:gDKW1LgppLRHMY0TBfJvjcTp5XHqv52mQYC0DKttAZaGB7AFRo7bYE:gDKW1Lgbdl0TBBvjc/O2mDaDI0Lybn

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks