vipkeylogger | afafc4178154c86f4eff17a3a6ee0a1f7a1ea201a03f43c3ff1b0109539092aa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 06:22

Target

PO202501F.exe
Size

2.8MB
MD5

0dd5014d304efb43d1ad1e58c746b96c
SHA1

01eb15c06ec35175e23c079d02ec27806bdc5580
SHA256

70fccd712c0675bda276231e600928b9a3bda595719e95adc5fb2b847b156bf9
SHA512

e9344b3aaa9cb5961b3dd8ae145c7dabbbb96104292ee9a9ed0e8ad4e0573c4446ea36568c4b2ca88a244fb5d299a4e549c086ab9faca5ba777ad6831620c7c2
SSDEEP

12288:pub1M1KYjZUnVZdAAaRgsYakHc5pgHApi3yQsXu/CV7O:pubi1DIDAVRgsSHsgHAhQsVV7O

Score

10^/10

Family

vipkeylogger

https://api.telegram.org/bot7965348925:AAGe8wdrvk9A3lxr1GIjGigodJ_zZ7prhfs/sendMessage?chat_id=6848903538

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4852 set thread context of 2472	4852	PO202501F.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	2472	WerFault.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84
PID 4852 wrote to memory of 2472	4852	PO202501F.exe	84

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2472 -ip 2472
1⤵
PID:3660

memory/2472-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download