Overview

overview

10

Static

static

5

New Order list.exe

windows7-x64

10

New Order list.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    23012025_1002_23012025_New Order list.pdf.z

  • Size

    847KB

  • Sample

    250123-l21gbswpdm

  • MD5

    7a24318082a5383731ff06679e3d7828

  • SHA1

    2214e865d093f6276ce343cae8bd837792fb416b

  • SHA256

    6ec2ccf980b1e357ff6db2afd3ab101d53fec45af702b48d5615e35c71afdbcc

  • SHA512

    c1f3e062f9db86cfba5993abaa840b88ffceb799e9732c017f32ee6390ef4bc09018d3556bc0758fe880c962a0e0c51c0ae4da1d3fdedabcf4f761a524efab3e

  • SSDEEP

    12288:CsNx+QKbK8kIyYCedTnjjzjYJ0tL+R/zBd7bTLBeVFJSJBvVLSWZbpPQayFC8L:CU+Q7KyXetVpaV5L38WpRtyIu

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    cash@com12345

Targets

    • Target

      New Order list.exe

    • Size

      1.2MB

    • MD5

      7d0c3e8ad0c9e73d5fb027a6ab1fd8e3

    • SHA1

      2fcc79b1030844814dde5d595f5b1aee2ed2455d

    • SHA256

      d67780a7f2fc2ded85c2ccdffdac398e9dac01759260536d61ef40744505ca91

    • SHA512

      e3a77e3fc6f9bacfb028ca56e62534de79cc0cc69709d5a8e36bb4d918881d59a2e478a1a21039c1a6f6a924be668c500bd5955869237628246a4802432d9885

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCR3wuPqiUQ8EXQ7ERG0e0IDzAFWhsF:7JZoQrbTFZY1iaCfhRAZt0J7

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks