vipkeylogger

General

Target

DHL DOC INV 191224.gz
Size

637KB
Sample

250102-pz7z6sslgw
MD5

bc1208cc0d3253ea79521035baff774a
SHA1

f6b4731a0c5328e1779db96a53b3f9b35a71e720
SHA256

e2d0f6cbfe202265b4765a2d623f510c5f086740de6e44226fb81f8f59242e26
SHA512

54fbc210fa0ffbb9aa921ee51b698a33f152e9a463881f8c410bd512a6f63793373803d2a0d65664491b520be4457b5281814b536da95308360d69a0e67b9fa5
SSDEEP

12288:oNk/gSX5EOm05YDBL9czEug8CgQKpSP8iBhscYO9VeqwTynnq3pRx4y:N/gSX5ClCzExviiIQ0OnKCy

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7289689475:AAGFe7RPg26YJkJcwIEyxRK_I9DsBw4teZU/sendMessage?chat_id=7360475312

Targets

- Target
  
  DHL DOC INV 191224.exe
- Size
  
  1.1MB
- MD5
  
  49a44e1bd7ae31824843c4316f35eb35
- SHA1
  
  29ca56d04c4d089d7aa30df2d3480988da425fc0
- SHA256
  
  9ea5173104481c6538cb5fcdadc74682b3d422750039ab3311afe694e59b4602
- SHA512
  
  c7e88ce41dd529f69d5a9aeb0d6a87fff85872215eb92815a67eb4b6533ff19a0e985572185b1ebda374635684ac8a1a7cde7737e780676ebb09f4d9aa98c600
- SSDEEP
  
  24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aThZqa2nU5:STvC/MTQYxsWR7aTd2
Score

10^/10

vipkeylogger discovery keylogger stealer
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Vipkeylogger family

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2