Overview

overview

10

Static

static

1

PO202501F.exe

windows7-x64

10

PO202501F.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    689d84d60434a515987bdd4f4f0d0bc33621d62ed47339bb6273f65258d92c55.zip

  • Size

    277KB

  • Sample

    250122-c5nghavjfp

  • MD5

    d1bf5f00d81e804d4b79d74964b4c76f

  • SHA1

    1a356956874be1a1bc8382dbee7a1c32578ce5a3

  • SHA256

    689d84d60434a515987bdd4f4f0d0bc33621d62ed47339bb6273f65258d92c55

  • SHA512

    006bc647cc1c6beefc5ebddeb345560142eb0ac15c86248e3038c945677a3363791c8b63a90392a3e7e2731384d14fa08e3643c8afb03d9cc8c9decd76251b24

  • SSDEEP

    6144:hZOA5IOBxaxAKW4fyHQOnHQGva0DKx+xz5ef5bIhK:hZ/JGxA/pbnwGiUKx+Fm5bIhK

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7965348925:AAGe8wdrvk9A3lxr1GIjGigodJ_zZ7prhfs/sendMessage?chat_id=6848903538

Targets

    • Target

      PO202501F.exe

    • Size

      713KB

    • MD5

      5006219231a8cb74552d0ad9c1b02ae9

    • SHA1

      1b54149f1d9c54d370c37fc00ad2e28642059c74

    • SHA256

      72fa904d41cfc7c04d3c095e84449aecb989cc98b1d008b3ce9b51717173b053

    • SHA512

      3a71ab78c5ad20325752a4e25267ba086e845cbbdd0452c138a9ac2367f7f5c181d9d1e2019307b4687a170b5ca212559ebe06c44fa43289ba8cdcfaef6a8a0d

    • SSDEEP

      12288:IPHkO6/ceaCdAA3w9zyaZyKgrwoyIgXCYAMA7Q:IPHkOXgAj9zVZgZDd7Q

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks