Overview

overview

10

Static

static

5

Statement ...14.exe

windows7-x64

10

Statement ...14.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Statement of Accounts-XXXXX8892-250120252003289814.exe

  • Size

    1.2MB

  • Sample

    250127-sswv4svlc1

  • MD5

    e5023c35a04e3597363d645715faa640

  • SHA1

    fadcd1b33f2abbd149c2afbae8472bc8dd8feb72

  • SHA256

    d600290473f4e9503e14d8d988bcb58b11b103471a7515212356c3c0aecc6657

  • SHA512

    7e7a8c02b376a9ceedfaa98d9d6427e6e11f015d43a3234d94200b3bbf7661a0722a2d6deefe95f021c1937440efb2e62f10b7beeab4f17e91f245fccd77f085

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaC4hxy+P4m2HrtKtD0HUqMM:7JZoQrbTFZY1iaC4i+eLtKqP

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials
C2

https://api.telegram.org/bot8066712820:AAEAb01u8B6eDO5xCMdAz6XCOHC_L2RpVGo/sendMessage?chat_id=7667424178

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Global786@

Targets

    • Target

      Statement of Accounts-XXXXX8892-250120252003289814.exe

    • Size

      1.2MB

    • MD5

      e5023c35a04e3597363d645715faa640

    • SHA1

      fadcd1b33f2abbd149c2afbae8472bc8dd8feb72

    • SHA256

      d600290473f4e9503e14d8d988bcb58b11b103471a7515212356c3c0aecc6657

    • SHA512

      7e7a8c02b376a9ceedfaa98d9d6427e6e11f015d43a3234d94200b3bbf7661a0722a2d6deefe95f021c1937440efb2e62f10b7beeab4f17e91f245fccd77f085

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaC4hxy+P4m2HrtKtD0HUqMM:7JZoQrbTFZY1iaC4i+eLtKqP

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks