vipkeylogger

General

Target

f2b4cbf30c6bb887655afe52c602d512221fdd185718786972f4cccdb2d0d04d
Size

609KB
Sample

241127-sapzvavjep
MD5

f943a1e32ea5f0c75b0fb257bc1723d9
SHA1

ca1abe785f06f5cd3e7412bf23e9549fef0da702
SHA256

f2b4cbf30c6bb887655afe52c602d512221fdd185718786972f4cccdb2d0d04d
SHA512

09fd65772dd4d2a9ac9eec31224d54edc66de7e30e7a7a83f622751e1167ae6fc97dde8b844f23a4e1aaf302128e6343d9ca45e1554524e4bb60047045233141
SSDEEP

12288:5vv10okrtvuIJvTgIwIuj7me86y1ke9GEoM0Tya/kQIDPI:dWokrtvJJvTZuj6xRkXEuTyVQIDPI

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7567650575:AAHvGGF6TZiX_cMd8iYGZUXmOL-zDO7vZNI/sendMessage?chat_id=7654658491

Targets

- Target
  
  PO#I-23-00007.exe
- Size
  
  1.0MB
- MD5
  
  fcf9d6b4116b8ed364365276d6e59e1b
- SHA1
  
  fc3f2846ae840756415e05ecbc4d8972af0c29d1
- SHA256
  
  a43a19822df06a57655413a8bb229547212eedd3b5271e3f4890212bbda5ceb0
- SHA512
  
  72e5ad59ac233d8566f5fd2c09c9d2a63557da59127328b1736eb1abc20e0c2066fb5ec8f670743266562ab93c9f30e1d0d47738c5729048a3cd41ccad962ee2
- SSDEEP
  
  12288:dtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgamTdAM8Tyarg0Am6A:dtb20pkaCqT5TBWgNQ7a+d+Tyd0Am6A
Score

10^/10

vipkeylogger collection discovery keylogger stealer
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Vipkeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.