Overview

overview

10

Static

static

5

HAFEEZ CHE...TD.exe

windows7-x64

10

HAFEEZ CHE...TD.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HAFEEZ CHEM GROUP CO.LTD.txz

  • Size

    852KB

  • Sample

    250120-sb6c8avnak

  • MD5

    c83f152d95089711cf0c0c084451c33d

  • SHA1

    407ac1516fb4ddcd9a0459fa2e7041cb47730482

  • SHA256

    c28cdb2da1b025c3f355063bb1bc410a32a44b75a0370e275900381ff0f0f53f

  • SHA512

    b51a486a3863e8a5b875ee0d1109c60b1048d40916aa1530cf5c29725464db6fcc5ba655c270a8b05a149ef0b9624ad6d0f4372290246acc2b3d2623a21ada0d

  • SSDEEP

    24576:hCF7mqzMjzEOZQbSf1wiagUaWLb4Gdxufdzf7NpLGtBLqLTV:C7mqzMLLafNdxQdzzrLGzG

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealerupx

Malware Config

Extracted

Family

vipkeylogger

Credentials
C2

https://api.telegram.org/bot7323823089:AAFBRsTW94zIpSoDS8yfGsotlQLqF2I6TU0/sendMessage?chat_id=5013849544

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.vvtrade.vn
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    qVyP6qyv6MQCmZJBRs4t

Targets

    • Target

      HAFEEZ CHEM GROUP CO.,LTD.exe

    • Size

      937KB

    • MD5

      bc7baa033dff24e20cf7180039f730f1

    • SHA1

      e63aa08c5ff536cc60859e76223405a83d15af25

    • SHA256

      ff8b7e1dd30b48c8c2144509dbf84b3103160a4fd8dcdb4341a782eb60592f0e

    • SHA512

      88a9768b65c0d6b7af3f29c4e8b2326ad38f1866445e11ccf7d9deeb97669e3514519226c881e07aaf6f335f4ad4de462a1f3a3e56446fa659e1ec3700e75715

    • SSDEEP

      24576:0thEVaPqLqn8vgIiregw+cVizAKDupFZZoJSyIU8is:IEVUcXVfPVWSxnis

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealerupx

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks