vipkeylogger | 4692-24-0x0000000000480000-0x00000000004CA000-memory[.]dmp | Triage

Sharing

General

Target

4692-24-0x0000000000480000-0x00000000004CA000-memory.dmp
Size

296KB
MD5

cbfee25edf9b2ed8d3ac75fe91b789bd
SHA1

1df74c2311bf7887abfe143eae5ddd421872233c
SHA256

f90d9eb5fe8cd2f34bfdf11e48ea0008f746b5b7d41ffbfafb9f1232e6b5bf85
SHA512

865a6b5ea416a7bd880a574e4d173ff2931679da2c53b31e64cd36bc78a17f8797aa4fb4f06a717f9610c0f225164e00e60a0c3dce1138c03a30dc506886c1d8
SSDEEP

3072:KBDmjDatnb/VWMhTLQeOXT1m+GYG1pHFpGPEayTg8OjNbfLxz8usoPXYTVgHi0b0:U1gNyTD0NbVzpZb

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.globalpharmaceuticalspk.com
Port:
587
Username:
[email protected]
Password:
Hira@gp@429
Email To:
[email protected]

Signatures

Vipkeylogger family
vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
4692-24-0x0000000000480000-0x00000000004CA000-memory.dmp

Files

4692-24-0x0000000000480000-0x00000000004CA000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ