Overview

overview

10

Static

static

5

SCHEFFER ...25.exe

windows7-x64

10

SCHEFFER ...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b3b4e96c1ec2ea5a49e69464edfa16ebd708a9cf5119f0ccb3d8078a41ce9cc.z

  • Size

    553KB

  • Sample

    250129-c3346s1mgn

  • MD5

    384c962dc1429cbba094fdc96279f33b

  • SHA1

    e516a10b73cac823da875eb88c5256c1819cd622

  • SHA256

    4b3b4e96c1ec2ea5a49e69464edfa16ebd708a9cf5119f0ccb3d8078a41ce9cc

  • SHA512

    1d2e3dc9c9385128d4ca9f79a1c8a138c2657ac44d81a015e8e25ad994a09536f6fbcd8e3c85f1e30a72a5e67526c8d6010b813c1ce0aca659f36b27a9f255fa

  • SSDEEP

    12288:vpEeTCe/gzBuIw41ZrmXswq+3hx9fmONpn7rl2+6b1rXsq4rsISGgdk:hEeT3/g4IwctT+3jAON5rl2++XitcC

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      SCHEFFER ORDER N. F-1676.25.exe

    • Size

      827KB

    • MD5

      6f41fbaa7470af3cc1c6194d997b63d6

    • SHA1

      9d10a3b0bf95d04c4834ebf380f22b7ad088c41e

    • SHA256

      a62c7c9c769aa4ffdd8729d5b5c688b1ef831be21d64247d75e7285d86e78af4

    • SHA512

      316df40ccb2cb77fc825f74e18ec03579211978438bfb8ab88e394d2d5f6008ae565efcba3dc52879c3953e90d930d788df3b2b78d14045ced315e48279f4cc7

    • SSDEEP

      12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCpeVyxldN/CLgUQr:uRmJkcoQricOIQxiZY1iaCpcap/q3G

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks