General
-
Target
4a374edfcf004d066dc1f2106fc3f424.bin
-
Size
717KB
-
Sample
241206-bpptysykep
-
MD5
dadb7634c57cc2b50ff5d55b66c5fc23
-
SHA1
e48917c7837fb77029a24c30af17b7ea37ead5ac
-
SHA256
4238406cea1a2adb56398d10dfdeb6ce7d2f4ede6a171ed3b891ff14aa88975e
-
SHA512
d4696165d1458bcd46162337736212ba718c1080c7b4f5378dd68c3a91a22f82049182d7851181c2601561e75a738aba8378484fc95f7136b07744f35718d1d6
-
SSDEEP
12288:GolMesVeuwf52azsg1TnUfcqObqfwOvq3MLog9Vlp9oDGjKxC23SlsveVZ4hZ5:rlM//wUaRZUfcqPfwO7oUXkJGCvez0z
Static task
static1
Behavioral task
behavioral1
Sample
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
Targets
-
-
Target
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a.exe
-
Size
1.1MB
-
MD5
4a374edfcf004d066dc1f2106fc3f424
-
SHA1
02bfae32ce46ad8ac2f8071801a923358794076c
-
SHA256
3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a
-
SHA512
26f705d618057e90541cff4240c51b1f4f634fb1030db4c91878064703ff2d735bfaa1c574bd23b75e57fa56995a0b9bf8ff04140a6599c577c60d5b003f5269
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FaPrgV3+9zoWxPZ4QUKLBSeWY:Xu0c++OCvkGs9FaPrgx+9s+PBUKL0Y
Score10/10-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-