Overview

overview

10

Static

static

5

MT 103 #00...df.exe

windows7-x64

10

MT 103 #00...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5bd6eb0c1c512aa7591bd95a3e5a4a9750cdfe93593dfc37b6c11931133a43e1.z

  • Size

    553KB

  • Sample

    250129-c71vls1pan

  • MD5

    b960e0ce987e50075542e15204eec92c

  • SHA1

    070a66fb0fff946a23fd0c0d185f4d6858cb0af3

  • SHA256

    5bd6eb0c1c512aa7591bd95a3e5a4a9750cdfe93593dfc37b6c11931133a43e1

  • SHA512

    190c3823ec215f2f5be648276dd6c16c9f97ea45e9992c722594f76d726902f625481d96d2f926070a7f7266fc5ab743f7bf2df64ef2f13946b4a193299c95cf

  • SSDEEP

    12288:FpEeTCe/gzBuIw41ZrmXswq+3hx9fmONpn7rl2+6b1rXsq4rsISGgdU:7EeT3/g4IwctT+3jAON5rl2++Xitcq

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.npmmachinery.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ^@SC}ST5oCG-

Targets

    • Target

      MT 103 #0012325132436402634.pdf.exe

    • Size

      827KB

    • MD5

      6f41fbaa7470af3cc1c6194d997b63d6

    • SHA1

      9d10a3b0bf95d04c4834ebf380f22b7ad088c41e

    • SHA256

      a62c7c9c769aa4ffdd8729d5b5c688b1ef831be21d64247d75e7285d86e78af4

    • SHA512

      316df40ccb2cb77fc825f74e18ec03579211978438bfb8ab88e394d2d5f6008ae565efcba3dc52879c3953e90d930d788df3b2b78d14045ced315e48279f4cc7

    • SSDEEP

      12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCpeVyxldN/CLgUQr:uRmJkcoQricOIQxiZY1iaCpcap/q3G

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks