General

  • Target

    1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe

  • Size

    203KB

  • Sample

    241111-w8wf3asndz

  • MD5

    b6e490fa6fec567c8732ca149530d494

  • SHA1

    bc95d371a5e4b19cb947a4d3795a3037c14df99b

  • SHA256

    42763b748282a9c448d6d055b4f3c6fec9471d3363e95ee418053a6d003bdbd3

  • SHA512

    551bf03a6a931ee26b7fc393b6331c4f9c37ab3ddb75078207aa008a5c9c1e6c44fbfd461674beaf70b930b4d54f5c21a2488d70faf2ce74068342c08124dcd0

  • SSDEEP

    3072:9DKW1LgppLRHMY0TBfJvjcTp5Xu/14MxQBHNcBM7OxiFbeCmFj7bY2:9DKW1Lgbdl0TBBvjc/sLi68O08Fvbx

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe

    • Size

      203KB

    • MD5

      b6e490fa6fec567c8732ca149530d494

    • SHA1

      bc95d371a5e4b19cb947a4d3795a3037c14df99b

    • SHA256

      42763b748282a9c448d6d055b4f3c6fec9471d3363e95ee418053a6d003bdbd3

    • SHA512

      551bf03a6a931ee26b7fc393b6331c4f9c37ab3ddb75078207aa008a5c9c1e6c44fbfd461674beaf70b930b4d54f5c21a2488d70faf2ce74068342c08124dcd0

    • SSDEEP

      3072:9DKW1LgppLRHMY0TBfJvjcTp5Xu/14MxQBHNcBM7OxiFbeCmFj7bY2:9DKW1Lgbdl0TBBvjc/sLi68O08Fvbx

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks