General
-
Target
18112024_1013_17112024_FacturaHonorarios2024-11-17.iso
-
Size
1.2MB
-
Sample
241118-mepxrazjhn
-
MD5
7bd3bd64bf67db003c1fa8561ae84b24
-
SHA1
47bcbd58c28b8b1df39c637a71ddcb4607071449
-
SHA256
9bb722ef59d92c1790b337db4ca2e150d61636f4aa9078e3478e7ac596c85a83
-
SHA512
de1abd6d443232ce2dcccecaafa1040fecac0028d2186b2ee5004b9413451295736bf5372623b4460ccd6e56f85a23bb6801fc45896701720d7a2e508fb62745
-
SSDEEP
12288:XTkuHDdugNuvuAE69ciyBfwKvpsQKnsk2axTs:XTRogNATSNJvqxTs
Static task
static1
Behavioral task
behavioral1
Sample
Factura Honorarios 2024-11-17.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Factura Honorarios 2024-11-17.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7807279596:AAEZM1QwkCh738-y0Qmnc3ubaoLMl6bUCVw/sendMessage?chat_id=7267131103
Targets
-
-
Target
Factura Honorarios 2024-11-17.exe
-
Size
685KB
-
MD5
2494d7b2fd14dc5604fd6aa412f170fc
-
SHA1
dc2b1e324c49c9f0fa446211ed24841c48371ef0
-
SHA256
0cf14ff76c5d927ad6de94e8d632592a776adb36c733680fcf6385a5d1fed069
-
SHA512
93543406973f6243703fa508a16c37166fc25227755eb97b62556a2d5370cd9b22bf21f0cb7c825b3d2fc4c727f623fa0fe586c0e653c3f9a48ef9a83dea6d90
-
SSDEEP
12288:fTkuHDdugNuvuAE69ciyBfwKvpsQKnsk2axTsy:fTRogNATSNJvqxTsy
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
75ed96254fbf894e42058062b4b4f0d1
-
SHA1
996503f1383b49021eb3427bc28d13b5bbd11977
-
SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
-
SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
SSDEEP
192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Score3/10 -
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2