Overview

overview

10

Static

static

5

DEBIT NOTE...23.exe

windows7-x64

10

DEBIT NOTE...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    23012025_1018_23012025_DEBIT NOTE Re Payment request CMA CGM __ - 1004053123.pdf.z

  • Size

    847KB

  • Sample

    250123-mb479sxkem

  • MD5

    d4aaf0162ca645d3139f930c89809320

  • SHA1

    fc7b8dc0522578482361d4a514212f888f7e9c6b

  • SHA256

    57579bbd9fba228c4db086ffd7f63f093c1f7b6ff94345a3397968a27260f1fc

  • SHA512

    42b73a85dec2699a0ad4eb745f7019844f45140e26d8f0ce61e2e84e01f7f0fb5568b26f2ed04274378f07327a7f729f771dcf35e05cb767562ff58529db13c6

  • SSDEEP

    12288:8sNx+QKbK8kIyYCedTnjjzjYJ0tL+R/zBd7bTLBeVFJSJBvVLSWZbpPQayFC8D:8U+Q7KyXetVpaV5L38WpRtyIg

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    cash@com12345

Targets

    • Target

      DEBIT NOTE Re Payment request CMA CGM 帐单 - 1004053123.exe

    • Size

      1.2MB

    • MD5

      7d0c3e8ad0c9e73d5fb027a6ab1fd8e3

    • SHA1

      2fcc79b1030844814dde5d595f5b1aee2ed2455d

    • SHA256

      d67780a7f2fc2ded85c2ccdffdac398e9dac01759260536d61ef40744505ca91

    • SHA512

      e3a77e3fc6f9bacfb028ca56e62534de79cc0cc69709d5a8e36bb4d918881d59a2e478a1a21039c1a6f6a924be668c500bd5955869237628246a4802432d9885

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCR3wuPqiUQ8EXQ7ERG0e0IDzAFWhsF:7JZoQrbTFZY1iaCfhRAZt0J7

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks