General
-
Target
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe
-
Size
929KB
-
Sample
241109-ek6hpaxcnr
-
MD5
49e9e776c6f5d00a090adbd8814ffdc7
-
SHA1
4ea5b8d7b7beb2ad75bbe583c4658093c4ab12bd
-
SHA256
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903
-
SHA512
06e761bafcf3aa68a739ec24f17db1f9d1a36f59b940c8de12fd388dbd871dd2ab443a60c7723cd77ec1f52859cef469d9493759acc8acc1cfe1c471bf06f8cd
-
SSDEEP
24576:L4GHnhIzOa5WPGzwQA+jLgNK5O5Y1fmdruuAF:0shdaYP3t+g3d
Behavioral task
behavioral1
Sample
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot6820629737:AAGJ8tOkoD9jFHkd_L1kG1ntQ1J6zLhFsMc/sendMessage?chat_id=6783205225
Targets
-
-
Target
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe
-
Size
929KB
-
MD5
49e9e776c6f5d00a090adbd8814ffdc7
-
SHA1
4ea5b8d7b7beb2ad75bbe583c4658093c4ab12bd
-
SHA256
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903
-
SHA512
06e761bafcf3aa68a739ec24f17db1f9d1a36f59b940c8de12fd388dbd871dd2ab443a60c7723cd77ec1f52859cef469d9493759acc8acc1cfe1c471bf06f8cd
-
SSDEEP
24576:L4GHnhIzOa5WPGzwQA+jLgNK5O5Y1fmdruuAF:0shdaYP3t+g3d
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-