General
-
Target
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a
-
Size
1.1MB
-
Sample
241204-eqgfrawphp
-
MD5
4a374edfcf004d066dc1f2106fc3f424
-
SHA1
02bfae32ce46ad8ac2f8071801a923358794076c
-
SHA256
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a
-
SHA512
26f705d618057e90541cff4240c51b1f4f634fb1030db4c91878064703ff2d735bfaa1c574bd23b75e57fa56995a0b9bf8ff04140a6599c577c60d5b003f5269
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FaPrgV3+9zoWxPZ4QUKLBSeWY:Xu0c++OCvkGs9FaPrgx+9s+PBUKL0Y
Static task
static1
Behavioral task
behavioral1
Sample
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
Targets
-
-
Target
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a
-
Size
1.1MB
-
MD5
4a374edfcf004d066dc1f2106fc3f424
-
SHA1
02bfae32ce46ad8ac2f8071801a923358794076c
-
SHA256
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a
-
SHA512
26f705d618057e90541cff4240c51b1f4f634fb1030db4c91878064703ff2d735bfaa1c574bd23b75e57fa56995a0b9bf8ff04140a6599c577c60d5b003f5269
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FaPrgV3+9zoWxPZ4QUKLBSeWY:Xu0c++OCvkGs9FaPrgx+9s+PBUKL0Y
Score10/10-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-