vipkeylogger | 2628-16-0x00000000007E0000-0x000000000082A000-memory[.]dmp | Triage

Sharing

General

Target

2628-16-0x00000000007E0000-0x000000000082A000-memory.dmp
Size

296KB
MD5

63d95c11f122a066a682e860377a65ca
SHA1

af259e935bc2272fe3b0b9c246ac4939ac149876
SHA256

587477198eb56700410e83a16ce9f0abcf6b5c016bf0f8ad8904df69ddf320e0
SHA512

cad471c97abeeac9650e844a1ed31ddf9b741e49a5a007deba62c670e228075c9a78f6a91b9bfd40ff9ad6017582ff71d24b6543fcadef29f8880b83a4cab05e
SSDEEP

3072:vtyjXWivxOdsmemmm+m9mrm+moZXwuTzNiJ6kLpHuUkyHG7DbfKloIUYTQ4i3bbY:cKLd5m7DbCkb

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.cipmach.com
Port:
587
Username:
[email protected]
Password:
mail@2019$
Email To:
[email protected]

Signatures

Vipkeylogger family
vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2628-16-0x00000000007E0000-0x000000000082A000-memory.dmp

Files

2628-16-0x00000000007E0000-0x000000000082A000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ