vipkeylogger

General

Target

07112024_0049_TEKJ09876545678002.xf.x.z
Size

936KB
Sample

241107-a6ke5a1hnb
MD5

6ee945cf8b745e3a0093f3eb1e9ff1cd
SHA1

17382785cf0c97a8b059a5ca537a4b9f4f743709
SHA256

6262d769543522102ee053e755410905d0cd170311e2114b4b240427cd1c6825
SHA512

5275727592516cedcf4f0d1052bcfd8b1e94d6d3b4b3c53cb17a82626776d2faf3b73d3d03d7cc582c13d2b26b39b473800e52112baed286b8cc169a90c8a718
SSDEEP

24576:xZZKbnfeg9mH8w+SqTaYxFZSKLCkdDRmrnZALsi0rrO68qWgXQ+0AH8:XQTfed3+SqTaWLCwoALsHrO6mp48

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.vvtrade.vn
Port:
587
Username:
[email protected]
Password:
qVyP6qyv6MQCmZJBRs4t

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendMessage?chat_id=6443825857

Targets

- Target
  
  TEKJ09876545678002.cmd
- Size
  
  1.3MB
- MD5
  
  8eefc053b6ed983bec5aff3dc3369b40
- SHA1
  
  84756cd09113665a8a8eba1d88da482bc276ada0
- SHA256
  
  49b3a5b9adc10281015d59ca3b9439cd1201712133895cb848d33c66c8fbb1bc
- SHA512
  
  60c0ced29238693be0cc2f4e20d219b4326fc4499ee216ddeb993714cd1565718f1af32f7a1af459845bcc1cd11ee0469189d54da86ebda4be651b7c4ff9a283
- SSDEEP
  
  24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8aLvxFjSOLmYtDRqrHZAZsi+xX06kGGsFG40b:lTvC/MTQYxsWR7aL9LmkGAZsFX06e/
Score

10^/10

vipkeylogger collection discovery keylogger stealer
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Vipkeylogger family

Drops startup file

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2