vipkeylogger | 2768-28-0x0000000000400000-0x0000000000448000-memory[.]dmp | Triage

Sharing

General

Target

2768-28-0x0000000000400000-0x0000000000448000-memory.dmp
Size

288KB
MD5

4a8df891e5cb3f07b64252f9f1ccc0f0
SHA1

291515d2ad1aa000a469c10d5440ed0fecfe2e8c
SHA256

329382636bcf62e4f66ddbdc636706b2e2bc8d38208e748e6ab3375149d5547a
SHA512

30b1328b5d064a02910242e2c840268eaef7045d2fc548f4e9229da623b295b2d35719a3f83c0e28da155bbc738c104027f042e7c73ec06fb74867373466d14d
SSDEEP

3072:tyLnzT+lcn52l37S7Q7b7b727Z7X7VvXHkeDrrp+CW1hbcodPLBIAmzbfaoJjs0F:5e5WXzI9bCo+db

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.vinatax.us
Port:
587
Username:
[email protected]
Password:
vinatax@2022
Email To:
[email protected]

Signatures

Vipkeylogger family
vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2768-28-0x0000000000400000-0x0000000000448000-memory.dmp

Files

2768-28-0x0000000000400000-0x0000000000448000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ