General
-
Target
490fe7bd44360112ebedc61afeedc1d73c65369d62a655c6c0e78b33023ce776
-
Size
592KB
-
Sample
241114-q9qz3stnfn
-
MD5
94237ab3bb74420c648c285c0e7b0147
-
SHA1
dccec8a4e8ee5054076665220920d93611d2c8fa
-
SHA256
490fe7bd44360112ebedc61afeedc1d73c65369d62a655c6c0e78b33023ce776
-
SHA512
3836a08e0868dc6f24cec606005c913a0b7df3ba6ea248c9b0bd326fbe0bab97b7086cde2202a6c41f9cce1995fc4ada806dc754baef14666aa88ffd02945d23
-
SSDEEP
12288:sdPKd4Ccv2Yw/T4fBIxno+P3lfPiFaAj26WQ9bUtGC7UsFgh2UfUUI8AaJ:sdPKKvLwsfmW+Plf6FaAFAttHFghPfUy
Malware Config
Extracted
Protocol: smtp- Host:
gain.co.id - Port:
587 - Username:
[email protected] - Password:
Gavur#123!!
Extracted
vipkeylogger
Protocol: smtp- Host:
gain.co.id - Port:
587 - Username:
[email protected] - Password:
Gavur#123!! - Email To:
[email protected]
Targets
-
-
Target
order.exe
-
Size
1019KB
-
MD5
d9db66e37915ab21e28573d7f6bf310e
-
SHA1
daa966d3d523214c4de2d70e958e3686618800b9
-
SHA256
9e7e7c7a7cfe618cb154602ed9de8022dea6c07420c0b5361d57c8e2016bb109
-
SHA512
6fde4ab22e6aa120b80f3f512976a74014758f698560c169d162d3288acb54a2ea39d5d8b5af4e77f67236b687c07d599f5862378c7b10c9084c989c79e1fa32
-
SSDEEP
24576:1tb20pkaCqT5TBWgNQ7aquX9g1Ffa/6A:mVg5tQ7aqAqm5
Score10/10-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-