General

  • Target

    e76d9a2e874a46b8ee74611cc3985a67972b73ce24fc1c8c0962e1a30f3f8c47.exe

  • Size

    202KB

  • Sample

    241107-dytwdatlft

  • MD5

    239fc62337835951e1d6b9e5ff4cc422

  • SHA1

    8a3e13851355e73b6e96a5601b83edc29e646fca

  • SHA256

    e76d9a2e874a46b8ee74611cc3985a67972b73ce24fc1c8c0962e1a30f3f8c47

  • SHA512

    5072063b48d70711681d2bc237ea6906ef0bbb737b170d81ec3cba185d97ee0603f8117c3503ab6fadc02ae53087c5d31d148c934f903ccc2988f0f8a1d199a8

  • SSDEEP

    3072:YDKW1LgppLRHMY0TBfJvjcTp5XsnDOgZ7NcSubXwMoQEYuB7bYS:YDKW1Lgbdl0TBBvjc/snCimLwxQ1upbh

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      e76d9a2e874a46b8ee74611cc3985a67972b73ce24fc1c8c0962e1a30f3f8c47.exe

    • Size

      202KB

    • MD5

      239fc62337835951e1d6b9e5ff4cc422

    • SHA1

      8a3e13851355e73b6e96a5601b83edc29e646fca

    • SHA256

      e76d9a2e874a46b8ee74611cc3985a67972b73ce24fc1c8c0962e1a30f3f8c47

    • SHA512

      5072063b48d70711681d2bc237ea6906ef0bbb737b170d81ec3cba185d97ee0603f8117c3503ab6fadc02ae53087c5d31d148c934f903ccc2988f0f8a1d199a8

    • SSDEEP

      3072:YDKW1LgppLRHMY0TBfJvjcTp5XsnDOgZ7NcSubXwMoQEYuB7bYS:YDKW1Lgbdl0TBBvjc/snCimLwxQ1upbh

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks