General
-
Target
82207ff3a7648d3ff7ee466bec68de79575f880a59b90df365bcfe576e3880e4.exe
-
Size
820KB
-
Sample
241107-c72f5swlfl
-
MD5
e37d56a547db8598645b412d482fdefb
-
SHA1
3399dd1717b169a04886cd3e1b097f07c079d844
-
SHA256
82207ff3a7648d3ff7ee466bec68de79575f880a59b90df365bcfe576e3880e4
-
SHA512
b5a1f92eccbfb6c1ebf6b95b52afa9af3587863b1ed466b89bb97c88e43e46bd61bd3fe2aa80ce67cfa948d3e2f07ff5b5cf4d92ac19025e86adfd8f4abd32ba
-
SSDEEP
12288:wbrX2lbu9ZZBmq3Vm1xUuQ5YtdD5SoijFSoOsZlP/wQxNym2y4n5df:Krmla953V8QOb50PNwmNym2fnn
Static task
static1
Behavioral task
behavioral1
Sample
82207ff3a7648d3ff7ee466bec68de79575f880a59b90df365bcfe576e3880e4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
82207ff3a7648d3ff7ee466bec68de79575f880a59b90df365bcfe576e3880e4.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
Protocol: ftp- Host:
kashmirestore.com - Port:
21 - Username:
[email protected] - Password:
c%P+6,(]YFvP
Extracted
vipkeylogger
Targets
-
-
Target
82207ff3a7648d3ff7ee466bec68de79575f880a59b90df365bcfe576e3880e4.exe
-
Size
820KB
-
MD5
e37d56a547db8598645b412d482fdefb
-
SHA1
3399dd1717b169a04886cd3e1b097f07c079d844
-
SHA256
82207ff3a7648d3ff7ee466bec68de79575f880a59b90df365bcfe576e3880e4
-
SHA512
b5a1f92eccbfb6c1ebf6b95b52afa9af3587863b1ed466b89bb97c88e43e46bd61bd3fe2aa80ce67cfa948d3e2f07ff5b5cf4d92ac19025e86adfd8f4abd32ba
-
SSDEEP
12288:wbrX2lbu9ZZBmq3Vm1xUuQ5YtdD5SoijFSoOsZlP/wQxNym2y4n5df:Krmla953V8QOb50PNwmNym2fnn
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2