General

  • Target

    8fcb7b52bb43d79e78a76244ad746e24a120fe1878491c543c42f75fe5010552.exe

  • Size

    203KB

  • Sample

    241127-c9gjrasrcs

  • MD5

    856c7834ab6127372257ccd6a895b1c6

  • SHA1

    936bfade0f82d7a0d51fe999b05bba1dd460e101

  • SHA256

    8fcb7b52bb43d79e78a76244ad746e24a120fe1878491c543c42f75fe5010552

  • SHA512

    4e6092c0258bdba4f61a68134fceca21d3f931119999f785c4ca862017470276d14be79b44d6f855da2d03b36b800728c3f9f1b7235a541f91c63cbcfe5df806

  • SSDEEP

    6144:jDKW1Lgbdl0TBBvjc/KF7HoU04PhtgEShbL:3h1Lk70TnvjcyRIOtHSlL

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      8fcb7b52bb43d79e78a76244ad746e24a120fe1878491c543c42f75fe5010552.exe

    • Size

      203KB

    • MD5

      856c7834ab6127372257ccd6a895b1c6

    • SHA1

      936bfade0f82d7a0d51fe999b05bba1dd460e101

    • SHA256

      8fcb7b52bb43d79e78a76244ad746e24a120fe1878491c543c42f75fe5010552

    • SHA512

      4e6092c0258bdba4f61a68134fceca21d3f931119999f785c4ca862017470276d14be79b44d6f855da2d03b36b800728c3f9f1b7235a541f91c63cbcfe5df806

    • SSDEEP

      6144:jDKW1Lgbdl0TBBvjc/KF7HoU04PhtgEShbL:3h1Lk70TnvjcyRIOtHSlL

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks