General

  • Target

    ungziped_file.exe

  • Size

    860KB

  • Sample

    241111-mvkb7sxnev

  • MD5

    a0d321aec52c65835cdddf42bc654541

  • SHA1

    708bd3f5b9036309f06bf616c61cf28a3db1f13b

  • SHA256

    98392e19d221d0f5440cdd47983162865a18f31bd1d3dbae289e11acdad4b2c6

  • SHA512

    c3c6c560a0f336f1f85af382ca7174a5a07243367ed2c6d43607a170a1435555b342333b5cb747989da7a6c7bec669a4867b46485a2d2230e2a07e2e6032857b

  • SSDEEP

    12288:ccMv6yXix9GAzQXH4kKCNyEJl8BYQrt6IDlkuaHnZ6/EGV+CsDZ:ccMvhybGAzQXtKfrYQp6IZkuS+pWZ

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      ungziped_file.exe

    • Size

      860KB

    • MD5

      a0d321aec52c65835cdddf42bc654541

    • SHA1

      708bd3f5b9036309f06bf616c61cf28a3db1f13b

    • SHA256

      98392e19d221d0f5440cdd47983162865a18f31bd1d3dbae289e11acdad4b2c6

    • SHA512

      c3c6c560a0f336f1f85af382ca7174a5a07243367ed2c6d43607a170a1435555b342333b5cb747989da7a6c7bec669a4867b46485a2d2230e2a07e2e6032857b

    • SSDEEP

      12288:ccMv6yXix9GAzQXH4kKCNyEJl8BYQrt6IDlkuaHnZ6/EGV+CsDZ:ccMvhybGAzQXtKfrYQp6IZkuS+pWZ

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks