General
-
Target
326d05c29c46e6ca7f2f1a9b534d8a2ffb98a13f74f8f26fff2057ad1f8e0ca8
-
Size
774KB
-
Sample
241205-wwvzrsslfm
-
MD5
34cc9882e5f377e3cedc9cd76033afca
-
SHA1
2fe1fb1c072b31f9df45170add68c6c7cf59d27d
-
SHA256
326d05c29c46e6ca7f2f1a9b534d8a2ffb98a13f74f8f26fff2057ad1f8e0ca8
-
SHA512
fc8c41243ee2fc468a2df74ec573ccb955a05b580ed7855c007079edbede6b2e4872de847b73d530809a67edb672ce9932b6be14309e300a32d05e4392c3b45e
-
SSDEEP
12288:BJqGG8+FBxjYKsZAEEErsEKbRsuKJJtJ7e+fGR4o58gkR:dCF7URXr3K9stJi+fGGo5u
Static task
static1
Behavioral task
behavioral1
Sample
326d05c29c46e6ca7f2f1a9b534d8a2ffb98a13f74f8f26fff2057ad1f8e0ca8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
326d05c29c46e6ca7f2f1a9b534d8a2ffb98a13f74f8f26fff2057ad1f8e0ca8.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7563060616:AAGgGu8pocoVNLzoow0Ge2U2GVDS9nDmL6Q/sendMessage?chat_id=7222025033
Targets
-
-
Target
326d05c29c46e6ca7f2f1a9b534d8a2ffb98a13f74f8f26fff2057ad1f8e0ca8
-
Size
774KB
-
MD5
34cc9882e5f377e3cedc9cd76033afca
-
SHA1
2fe1fb1c072b31f9df45170add68c6c7cf59d27d
-
SHA256
326d05c29c46e6ca7f2f1a9b534d8a2ffb98a13f74f8f26fff2057ad1f8e0ca8
-
SHA512
fc8c41243ee2fc468a2df74ec573ccb955a05b580ed7855c007079edbede6b2e4872de847b73d530809a67edb672ce9932b6be14309e300a32d05e4392c3b45e
-
SSDEEP
12288:BJqGG8+FBxjYKsZAEEErsEKbRsuKJJtJ7e+fGR4o58gkR:dCF7URXr3K9stJi+fGGo5u
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2