Overview

overview

10

Static

static

3

dhl dan new.exe

windows7-x64

10

dhl dan new.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ac106980da07741a251799e9510947e2b2b17e49e8390b4094c213044d093de

  • Size

    543KB

  • Sample

    250131-r5p3nazrgk

  • MD5

    9e01bb3c862375b50594e9aadcefc29f

  • SHA1

    a17100edc68d39e5ebc4d51ae6201e82cb55859d

  • SHA256

    3ac106980da07741a251799e9510947e2b2b17e49e8390b4094c213044d093de

  • SHA512

    b2ef2633b48428af089143384121f9f0a6fb5cc800d45e4cdebeec09f68c46537f184049f00bdd5a17941890dd06a99b2039cb0ec2a2508ff379fd9c0f1636c2

  • SSDEEP

    12288:GBDBUyHx6xg1emy/8bceDV3Cnr3s9nxQ5yoZkADUo+kw5AkO5:sSrg+/8bceNCnYnxYyoZzwodwqkO5

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      dhl dan new.exe

    • Size

      831KB

    • MD5

      b0edddea096da2d43a9d822059485c64

    • SHA1

      2eccf68812432927ee82ee74668c6b04d1c49fce

    • SHA256

      fb024df91ee3c67ef0fa46d6ee46804a2363b84110a5e9b2562283383eb262ab

    • SHA512

      1b2b9159f6e9e25b5ee133cff0fda2f50e2476e2e32317dcc9e2c9c2f0654eef3a2e559e44eb81ee151cde2d0017f9f8a10bb2eb4ef9f6d7b3f6c460f4e47844

    • SSDEEP

      12288:9nEsBqGHxgx01Gmib8DcejVT6nF3c9nNs/1HTATPZLoLB69TD:ZEVr0yb8DceF6ninNG1YloI

    Score
    10/10
    vipkeyloggerdiscoverykeyloggerstealercollection

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks