General
-
Target
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba
-
Size
845KB
-
Sample
241212-nhkmwasldz
-
MD5
cb523e6e862bd251045595ef012615d5
-
SHA1
168a3053da5319d12f101fecba8eaeca666babc5
-
SHA256
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba
-
SHA512
1f86be31eb36ec759b892b58302c40b139c22c344c3fefea438b75ab10a945a27463f446286fe348a28e6517877b3db29a0984360b0b964fa0de787d9e598c55
-
SSDEEP
12288:nGMMwy9EXX+8bKz539a3LSTJofJWADQR5+4hONdLW2miS7:wwFO8bKzp9aWTW0ADQR5bhO2f
Static task
static1
Behavioral task
behavioral1
Sample
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
Targets
-
-
Target
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba
-
Size
845KB
-
MD5
cb523e6e862bd251045595ef012615d5
-
SHA1
168a3053da5319d12f101fecba8eaeca666babc5
-
SHA256
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba
-
SHA512
1f86be31eb36ec759b892b58302c40b139c22c344c3fefea438b75ab10a945a27463f446286fe348a28e6517877b3db29a0984360b0b964fa0de787d9e598c55
-
SSDEEP
12288:nGMMwy9EXX+8bKz539a3LSTJofJWADQR5+4hONdLW2miS7:wwFO8bKzp9aWTW0ADQR5bhO2f
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2