General

  • Target

    e275dfa60c086c3cab4924b19964370b84df960a25fb6c4303a3c0b179acb62d.exe

  • Size

    271KB

  • Sample

    241203-dme8vaxjhv

  • MD5

    e681538de4634454ceeb048953383882

  • SHA1

    a7f7c93dacc6bbd8d12564dec0bc5c5c8a8d6dd0

  • SHA256

    e275dfa60c086c3cab4924b19964370b84df960a25fb6c4303a3c0b179acb62d

  • SHA512

    5de5552533da23a6c250723c3d19fc9afce907fe9f7c339b9417dd26ebe89b28937728de1e498d8e979e72af92f5266fc467ab6551757f34057424078d15fa65

  • SSDEEP

    6144:1K0jMsk4ciMA4W+hlEyUaq+YaeQB99PvPdHDYvCxG8b1ESb:1K0jMsk4ciMA4W+hlEyUaq+YaeQB99Pv

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7331041604:AAE-Us7UbUFSJts_TZoHHXgsfP7KSC7d5do/sendMessage?chat_id=7422462541

Targets

    • Target

      e275dfa60c086c3cab4924b19964370b84df960a25fb6c4303a3c0b179acb62d.exe

    • Size

      271KB

    • MD5

      e681538de4634454ceeb048953383882

    • SHA1

      a7f7c93dacc6bbd8d12564dec0bc5c5c8a8d6dd0

    • SHA256

      e275dfa60c086c3cab4924b19964370b84df960a25fb6c4303a3c0b179acb62d

    • SHA512

      5de5552533da23a6c250723c3d19fc9afce907fe9f7c339b9417dd26ebe89b28937728de1e498d8e979e72af92f5266fc467ab6551757f34057424078d15fa65

    • SSDEEP

      6144:1K0jMsk4ciMA4W+hlEyUaq+YaeQB99PvPdHDYvCxG8b1ESb:1K0jMsk4ciMA4W+hlEyUaq+YaeQB99Pv

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks