General

  • Target

    18112024_1013_17112024_FacturaHonorarios2024-11-17.iso

  • Size

    1.2MB

  • Sample

    241118-mepxrazjhn

  • MD5

    7bd3bd64bf67db003c1fa8561ae84b24

  • SHA1

    47bcbd58c28b8b1df39c637a71ddcb4607071449

  • SHA256

    9bb722ef59d92c1790b337db4ca2e150d61636f4aa9078e3478e7ac596c85a83

  • SHA512

    de1abd6d443232ce2dcccecaafa1040fecac0028d2186b2ee5004b9413451295736bf5372623b4460ccd6e56f85a23bb6801fc45896701720d7a2e508fb62745

  • SSDEEP

    12288:XTkuHDdugNuvuAE69ciyBfwKvpsQKnsk2axTs:XTRogNATSNJvqxTs

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7807279596:AAEZM1QwkCh738-y0Qmnc3ubaoLMl6bUCVw/sendMessage?chat_id=7267131103

Targets

    • Target

      Factura Honorarios 2024-11-17.exe

    • Size

      685KB

    • MD5

      2494d7b2fd14dc5604fd6aa412f170fc

    • SHA1

      dc2b1e324c49c9f0fa446211ed24841c48371ef0

    • SHA256

      0cf14ff76c5d927ad6de94e8d632592a776adb36c733680fcf6385a5d1fed069

    • SHA512

      93543406973f6243703fa508a16c37166fc25227755eb97b62556a2d5370cd9b22bf21f0cb7c825b3d2fc4c727f623fa0fe586c0e653c3f9a48ef9a83dea6d90

    • SSDEEP

      12288:fTkuHDdugNuvuAE69ciyBfwKvpsQKnsk2axTsy:fTRogNATSNJvqxTsy

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks