Behavioral task
behavioral1
Sample
2025-01-18_a89e0e692169c162dff3c7024917eec8_hiddentear.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-01-18_a89e0e692169c162dff3c7024917eec8_hiddentear.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-18_a89e0e692169c162dff3c7024917eec8_hiddentear
-
Size
384KB
-
MD5
a89e0e692169c162dff3c7024917eec8
-
SHA1
f54f40c9d9eb7326be93dfb989b69872ed136d0b
-
SHA256
e96b351e13be54347e00aa6b993307eee52a36f0f411dc3dad92fad38d7c6a52
-
SHA512
46aa559cbedd9634b20bc7b24e7489f980771cb5d690a3097cd22a28cc77890340fbc1766cfe86ad134b8f73560fbea94f76d5fd07b03d81fe97f297edad9364
-
SSDEEP
3072:WMXj4/d9CObeWp90dimWf3icfRoNNFRuHcjAxH0E0lXhvWRQbOPt97UmiLVBTKBo:04Obe498rEIlWebKOH+lDAADb
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7965348925:AAGe8wdrvk9A3lxr1GIjGigodJ_zZ7prhfs/sendMessage?chat_id=6848903538
Signatures
-
Vipkeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-18_a89e0e692169c162dff3c7024917eec8_hiddentear
Files
-
2025-01-18_a89e0e692169c162dff3c7024917eec8_hiddentear.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ