Overview

overview

10

Static

static

5

Impreso_or...41.exe

windows7-x64

10

Impreso_or...41.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    669a93a6fbe06ca416d629ee017696cc2cf4d12256d3262ab2a91070e021b36d

  • Size

    544KB

  • Sample

    250127-wcpzeazlht

  • MD5

    b52a8aa1532839145980cba7e451af83

  • SHA1

    5d1fb32aa7eb3de0a56750b3f0e7c543a4a7a523

  • SHA256

    669a93a6fbe06ca416d629ee017696cc2cf4d12256d3262ab2a91070e021b36d

  • SHA512

    bda1a6919c8a9a8e110059829196c91edf21e888c7e443e7dda42d341126569535439d9836553e714a0d7d513929615b013f615428ec8e17ee3e9583a768b501

  • SSDEEP

    12288:kmbvh3HKKkQrMrWo2+YAo4JOCSkh8R7QA8mziIieAd7jK:kiJHKKknrTvYn4c9kk1/0jK

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      Impreso_orden_carga_ventas_52_6179_27012025_51741.exe

    • Size

      840KB

    • MD5

      7c7f5065d0ddaa204dbf30d2c5d624f7

    • SHA1

      2cafcf3ab758ea2a0b3a91136e7db707d983164e

    • SHA256

      349351cbc7fc50949df3ddbf744d5a70a1611e73daeaf35763e4d56ca9ae67de

    • SHA512

      f3a583c6ec3f256c02797391de368b8ad036524c5804dffe46f20dbed1ab6ce62ec4db48163354f4bc04ada8a152a9c006efed05d082d506dca005e73d07c6ed

    • SSDEEP

      12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCFkj8RrQAgmziIaeAu7jr:uRmJkcoQricOIQxiZY1iaCFs+17Njr

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks