General

  • Target

    ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe

  • Size

    929KB

  • Sample

    241109-ek6hpaxcnr

  • MD5

    49e9e776c6f5d00a090adbd8814ffdc7

  • SHA1

    4ea5b8d7b7beb2ad75bbe583c4658093c4ab12bd

  • SHA256

    ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903

  • SHA512

    06e761bafcf3aa68a739ec24f17db1f9d1a36f59b940c8de12fd388dbd871dd2ab443a60c7723cd77ec1f52859cef469d9493759acc8acc1cfe1c471bf06f8cd

  • SSDEEP

    24576:L4GHnhIzOa5WPGzwQA+jLgNK5O5Y1fmdruuAF:0shdaYP3t+g3d

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot6820629737:AAGJ8tOkoD9jFHkd_L1kG1ntQ1J6zLhFsMc/sendMessage?chat_id=6783205225

Targets

    • Target

      ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe

    • Size

      929KB

    • MD5

      49e9e776c6f5d00a090adbd8814ffdc7

    • SHA1

      4ea5b8d7b7beb2ad75bbe583c4658093c4ab12bd

    • SHA256

      ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903

    • SHA512

      06e761bafcf3aa68a739ec24f17db1f9d1a36f59b940c8de12fd388dbd871dd2ab443a60c7723cd77ec1f52859cef469d9493759acc8acc1cfe1c471bf06f8cd

    • SSDEEP

      24576:L4GHnhIzOa5WPGzwQA+jLgNK5O5Y1fmdruuAF:0shdaYP3t+g3d

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks