General

  • Target

    bc662398656d898124d02324a3760f0665a13ad5ff5d158ca23fd63757b778cc.img

  • Size

    1.6MB

  • Sample

    241204-dpnm1avjbm

  • MD5

    a7a122948a7b3283c004c12beeff41c2

  • SHA1

    52e0e95de531c1fc5a25b82af5be1333271a379e

  • SHA256

    bc662398656d898124d02324a3760f0665a13ad5ff5d158ca23fd63757b778cc

  • SHA512

    ecd6d0f7925e37c9698f3cd2bd559583f91182ea7006616bf5195d4c5365d437efedec267366b35b46cabd1f447c1756bebb28b90d84dc9e5b363d22d38ee624

  • SSDEEP

    24576:cu6J33O0c+JY5UZ+XC0kGso6Fa/tgAKWY:Gu0c++OCvkGs9Fa/tgYY

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      Płatność 8557899,jpg.exe

    • Size

      1.1MB

    • MD5

      741eea55925237502bf85c1b86e4012b

    • SHA1

      0104879889fd5440e59978a98d6f715fa4a79c86

    • SHA256

      678fa6d49ff14e29a6a534db4ac0ad1f3aa9538101d2b6ed4aef40cedd8b4339

    • SHA512

      ab917b2694b00daeacbda1d82c72259316a4753e991e80ee0f2aa247d7df90268cdf46b27a2b166cfcb36b6ecd0e0ab4476b08aa138a66f0c634bbea100aaeb1

    • SSDEEP

      24576:Hu6J33O0c+JY5UZ+XC0kGso6Fa/tgAKWY:Bu0c++OCvkGs9Fa/tgYY

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks