General

  • Target

    FacturaHonorarios2024-11-17.exe

  • Size

    685KB

  • Sample

    241118-kmk8essfmb

  • MD5

    2494d7b2fd14dc5604fd6aa412f170fc

  • SHA1

    dc2b1e324c49c9f0fa446211ed24841c48371ef0

  • SHA256

    0cf14ff76c5d927ad6de94e8d632592a776adb36c733680fcf6385a5d1fed069

  • SHA512

    93543406973f6243703fa508a16c37166fc25227755eb97b62556a2d5370cd9b22bf21f0cb7c825b3d2fc4c727f623fa0fe586c0e653c3f9a48ef9a83dea6d90

  • SSDEEP

    12288:fTkuHDdugNuvuAE69ciyBfwKvpsQKnsk2axTsy:fTRogNATSNJvqxTsy

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7807279596:AAEZM1QwkCh738-y0Qmnc3ubaoLMl6bUCVw/sendMessage?chat_id=7267131103

Targets

    • Target

      FacturaHonorarios2024-11-17.exe

    • Size

      685KB

    • MD5

      2494d7b2fd14dc5604fd6aa412f170fc

    • SHA1

      dc2b1e324c49c9f0fa446211ed24841c48371ef0

    • SHA256

      0cf14ff76c5d927ad6de94e8d632592a776adb36c733680fcf6385a5d1fed069

    • SHA512

      93543406973f6243703fa508a16c37166fc25227755eb97b62556a2d5370cd9b22bf21f0cb7c825b3d2fc4c727f623fa0fe586c0e653c3f9a48ef9a83dea6d90

    • SSDEEP

      12288:fTkuHDdugNuvuAE69ciyBfwKvpsQKnsk2axTsy:fTRogNATSNJvqxTsy

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks