vipkeylogger

General

Target

3C81CD20323C282181D40FA0E8AB7B66DFD46EDD7BAFC3D6ABEB072420B314FE.exe
Size

1.0MB
Sample

250103-kqe6kswmez
MD5

3e473d16c81dd66fee6f02537b601626
SHA1

82f7667f0d8aecc63ce5fb9d86ec3d651223676d
SHA256

3c81cd20323c282181d40fa0e8ab7b66dfd46edd7bafc3d6abeb072420b314fe
SHA512

7f3ff26741dd497f8c2f8fb9a63de6c16140203446d35b277be71031070c882c97171448f8b15346f04868b5630d5ff99af101cc3b1f66345b053acd386fcc28
SSDEEP

24576:FAHnh+eWsN3skA4RV1Hom2KXMmHapvZqN9y7gYaM5:0h+ZkldoPK8YapvZO9y7Vt

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.tradolgt.com
Port:
587
Username:
[email protected]
Password:
445566nniI
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.tradolgt.com
Port:
587
Username:
[email protected]
Password:
445566nniI

Targets

- Target
  
  3C81CD20323C282181D40FA0E8AB7B66DFD46EDD7BAFC3D6ABEB072420B314FE.exe
- Size
  
  1.0MB
- MD5
  
  3e473d16c81dd66fee6f02537b601626
- SHA1
  
  82f7667f0d8aecc63ce5fb9d86ec3d651223676d
- SHA256
  
  3c81cd20323c282181d40fa0e8ab7b66dfd46edd7bafc3d6abeb072420b314fe
- SHA512
  
  7f3ff26741dd497f8c2f8fb9a63de6c16140203446d35b277be71031070c882c97171448f8b15346f04868b5630d5ff99af101cc3b1f66345b053acd386fcc28
- SSDEEP
  
  24576:FAHnh+eWsN3skA4RV1Hom2KXMmHapvZqN9y7gYaM5:0h+ZkldoPK8YapvZO9y7Vt
Score

10^/10

vipkeylogger collection discovery keylogger stealer
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Vipkeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2