vipkeylogger | 2812-11-0x0000000000400000-0x0000000000448000-memory[.]dmp | Triage

Sharing

General

Target

2812-11-0x0000000000400000-0x0000000000448000-memory.dmp
Size

288KB
MD5

94820d65e3716f9e613fca4a15de4bac
SHA1

c9fba4c4bf744f6aab5107ff0e75046827321534
SHA256

c35c19ac8732fc6438df69ba28961baa0af5eb277dff773f282898c0f2a7f9fc
SHA512

d270a381e509ee5b86e1bc5a579aae4a3f40276fe203dc00f9cc181fd66a5216c28b8252a39ad77a3e44eb28c1560a9da02cc96c58ff5d7fe92a0072eb0ccb05
SSDEEP

3072:q+OPH2MS7ZHlUSQvZXdYhJF24A+c2cxNnXr75agycd3gc0NhtHduumiQ/JRofI07:ukkGqWVry1nVb2clb

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
h2-eu1.layer6.net
Port:
587
Username:
[email protected]
Password:
7213575aceACE@@
Email To:
[email protected]

Signatures

Vipkeylogger family
vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2812-11-0x0000000000400000-0x0000000000448000-memory.dmp

Files

2812-11-0x0000000000400000-0x0000000000448000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ