General

  • Target

    pre-stowage.PDF.scr.exe

  • Size

    886KB

  • Sample

    241217-h9ja8stpex

  • MD5

    68dfd91fce9ad3d728a7c25716990edd

  • SHA1

    6a6843531a77b77892813360b3daf0b0bbfea8c2

  • SHA256

    525248e53005e0ec5a39b4aa00c2323e9f5be5a256ddd944707aba1b3dedba58

  • SHA512

    cb16e579c818d63d4be0798211ef3d4f36728804280920d4508366d5a65c2c6c237452fc7cce112c8baba49f481b89c132e9accee541eab26424bfd80df63049

  • SSDEEP

    12288:GqktMolx2euSXxT4lfsvAt75PAXfZ0mA4t3Rx5Z5MpaXv0cWP2vMPku+l0CPP:gtZPpXStlaRNJJRb8pqvmPd+p

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      pre-stowage.PDF.scr.exe

    • Size

      886KB

    • MD5

      68dfd91fce9ad3d728a7c25716990edd

    • SHA1

      6a6843531a77b77892813360b3daf0b0bbfea8c2

    • SHA256

      525248e53005e0ec5a39b4aa00c2323e9f5be5a256ddd944707aba1b3dedba58

    • SHA512

      cb16e579c818d63d4be0798211ef3d4f36728804280920d4508366d5a65c2c6c237452fc7cce112c8baba49f481b89c132e9accee541eab26424bfd80df63049

    • SSDEEP

      12288:GqktMolx2euSXxT4lfsvAt75PAXfZ0mA4t3Rx5Z5MpaXv0cWP2vMPku+l0CPP:gtZPpXStlaRNJJRb8pqvmPd+p

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Disables Task Manager via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.