General

  • Target

    Curriculum Vitae Estrella Torres.exe

  • Size

    864KB

  • Sample

    241110-g4whyavjem

  • MD5

    abc05276ba6305e8fdbf08b1cfa8a005

  • SHA1

    50aa13bd7ef461bce463b6d3d033d89c22bb22e0

  • SHA256

    c43f4d0f453155a1a2b83f793bcaf83429cc7c6452f430a1763eec9a31fd70a0

  • SHA512

    7fe9ad83fdcec2ba857b9ad65056e3b9e94db7f402de266005ea1c086214803df28f8ca1ca1ce739fa4b513a77a5f950c2ad9aaad88895c8a00042d2c6bbe5ef

  • SSDEEP

    24576:VBoxRSK/hLdpel2qkQTeYH0EA66TdCrfs4Pix12bUsua:cHSYdckQ6Y5A55CNPix12Vu

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7771785357:AAGIjPnBZrH4W2USOpZoA66yRS239AIaI8U/sendMessage?chat_id=6370711846

Targets

    • Target

      Curriculum Vitae Estrella Torres.exe

    • Size

      864KB

    • MD5

      abc05276ba6305e8fdbf08b1cfa8a005

    • SHA1

      50aa13bd7ef461bce463b6d3d033d89c22bb22e0

    • SHA256

      c43f4d0f453155a1a2b83f793bcaf83429cc7c6452f430a1763eec9a31fd70a0

    • SHA512

      7fe9ad83fdcec2ba857b9ad65056e3b9e94db7f402de266005ea1c086214803df28f8ca1ca1ce739fa4b513a77a5f950c2ad9aaad88895c8a00042d2c6bbe5ef

    • SSDEEP

      24576:VBoxRSK/hLdpel2qkQTeYH0EA66TdCrfs4Pix12bUsua:cHSYdckQ6Y5A55CNPix12Vu

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks