Overview

overview

10

Static

static

5

Receipt Co...df.exe

windows7-x64

10

Receipt Co...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67635b427ae1c424974bbaa7c6e055dc659e87d074b965afb414c10fa2c71bd9.rar

  • Size

    603KB

  • Sample

    250130-dt1s5axkhx

  • MD5

    f6a7479bd71229c0282b11675c165ebc

  • SHA1

    5cf0fd1e68deada7f2fce5c7f17e8c2675b382e7

  • SHA256

    67635b427ae1c424974bbaa7c6e055dc659e87d074b965afb414c10fa2c71bd9

  • SHA512

    7345dc9328e75c0a97154371a828acfa126c704307d5f193842980f0e12fce0b29ee5300f6fea90ea3b57bd8c85e7b45f00a72731d422a6d97d81b55d0fdc1e9

  • SSDEEP

    12288:jwMBq7rgVkOEZS2VyuMsxxYx6OauBp8Z3As1xZDiZojBsb40wrBnS:jwMYPt/ZHIoYpGZws1xZDiSjBBbrBS

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      Receipt Copy001pdf.exe

    • Size

      993KB

    • MD5

      5b15cda50a751110bb9c7f1fe8eb3b2f

    • SHA1

      62547ae272eb9be69ad5fd565782dc569b453ec7

    • SHA256

      aaee9ff9746646836f3538beea0c59fb1c83ee095023d09899238ae732bd190e

    • SHA512

      d1a1157df7a54ebde01903031224dfef6cbfc548ff853cec1edfe85d1abb5472e7128e1bc1c4c0fcd8f63fb2516655780f1bdbfa2721eada862f6e8dbbfe831f

    • SSDEEP

      24576:yAHnh+eWsN3skA4RV1Hom2KXFmIaMfRIHnJ1RvKr3m5:1h+ZkldoPK1XaMGHnJ1srs

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks