General

  • Target

    7d8d238f51adccea0240ec51a8abb78ab4b1fa40a3f856abcc7d372e56a5fe42.exe

  • Size

    620KB

  • Sample

    241130-c87dsayjfs

  • MD5

    ba060f3ccbb40c96956ee61939944c57

  • SHA1

    840f6a8241a4db921713ff2efdbf961216c72ff7

  • SHA256

    7d8d238f51adccea0240ec51a8abb78ab4b1fa40a3f856abcc7d372e56a5fe42

  • SHA512

    f455c6cab0018824132a5a35daaaba6af70aef3d52a40e336b4de8ae78aee174bc3c1b8c57f74fcbf122b52a813ce664e169c95072f37555c3c3ed004885b224

  • SSDEEP

    12288:MaF8kdTrFTFJ3b0pcVYGyRIDOYswSLQLMZg2zRP5cu4FhH610QKhK:M68iJbicVYGxDOp+M/hj4/HwIA

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      7d8d238f51adccea0240ec51a8abb78ab4b1fa40a3f856abcc7d372e56a5fe42.exe

    • Size

      620KB

    • MD5

      ba060f3ccbb40c96956ee61939944c57

    • SHA1

      840f6a8241a4db921713ff2efdbf961216c72ff7

    • SHA256

      7d8d238f51adccea0240ec51a8abb78ab4b1fa40a3f856abcc7d372e56a5fe42

    • SHA512

      f455c6cab0018824132a5a35daaaba6af70aef3d52a40e336b4de8ae78aee174bc3c1b8c57f74fcbf122b52a813ce664e169c95072f37555c3c3ed004885b224

    • SSDEEP

      12288:MaF8kdTrFTFJ3b0pcVYGyRIDOYswSLQLMZg2zRP5cu4FhH610QKhK:M68iJbicVYGxDOp+M/hj4/HwIA

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks