General

  • Target

    fee0b8865899da1720465b19e0eaa7306695c8b04954531b06c6857261d11829.exe

  • Size

    1.2MB

  • Sample

    241111-mvjqnsybmq

  • MD5

    6b92e78943361dd41cf3239446b054fa

  • SHA1

    484da2ba7918728ca7c4054fd6152e32bcf668a7

  • SHA256

    fee0b8865899da1720465b19e0eaa7306695c8b04954531b06c6857261d11829

  • SHA512

    234b1647db67c1d03d65eed66e1886c96a246a44c955282b909d316f8c5cc39c535d6286faa99f28fcfb2cbc3ef766f9743954a2224ec5e1d52617bd42ce7c6d

  • SSDEEP

    24576:LRmJkcoQricOIQxiZY1WNyPVjnT8m5EvHacbW:IJZoQrbTFZY1WNyRnQhHDbW

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.asesoriategueste.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    2[K9AW)mvDqL

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      fee0b8865899da1720465b19e0eaa7306695c8b04954531b06c6857261d11829.exe

    • Size

      1.2MB

    • MD5

      6b92e78943361dd41cf3239446b054fa

    • SHA1

      484da2ba7918728ca7c4054fd6152e32bcf668a7

    • SHA256

      fee0b8865899da1720465b19e0eaa7306695c8b04954531b06c6857261d11829

    • SHA512

      234b1647db67c1d03d65eed66e1886c96a246a44c955282b909d316f8c5cc39c535d6286faa99f28fcfb2cbc3ef766f9743954a2224ec5e1d52617bd42ce7c6d

    • SSDEEP

      24576:LRmJkcoQricOIQxiZY1WNyPVjnT8m5EvHacbW:IJZoQrbTFZY1WNyRnQhHDbW

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks