General

  • Target

    0f53eff52887aae5e364992c447a0816efaac51fd03539713b13d502bcfed409

  • Size

    729KB

  • Sample

    250213-s8cr6szqdx

  • MD5

    c012d698c88ef1c05a0de57e7b72dcac

  • SHA1

    f1847e326ab575c00aec906804f0443e90d7e7a5

  • SHA256

    0f53eff52887aae5e364992c447a0816efaac51fd03539713b13d502bcfed409

  • SHA512

    b80a0f01e0e24fd6aec3b7aff725d517f872564fa364298d748b50796ce68a99c63e2ccf883402f48309ee5a15c5c1dabaa5f69daecb496de9382afc8fb37ddc

  • SSDEEP

    12288:bCFbVCK02/vw5mPZID2oGyqey5T+ZJg3mQPgkMzlLflZY4h+yk+j:OFVG23wGloGoOT+Zy2QPxeZY41Tj

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7618867847:AAF14vnGvkJJYcxLyMVdR3OZPzd4TQzD_OY/sendMessage?chat_id=6070006284

Targets

    • Target

      Cubistic.exe

    • Size

      744KB

    • MD5

      615dbc6bbf1babd9d064ec9d24b211b1

    • SHA1

      5465ddcd9aa36db67f3a29607f86c4df6989d026

    • SHA256

      f1b6f735c651a28ecb97d4b9e21adc5d79ebed5b2686482f58ae33df3f13492d

    • SHA512

      3a0d4769020d220676907a71d8fea5e2d61ca2e6d3ae79be14a7b4b5a99c78b03c044619e3c55c8a1e76f660cee26638932fd846ec580f8ad72b551d41cfdb04

    • SSDEEP

      12288:lF9eqV6zZSsoOa/xy38SeD83S1vKZbXvOIxnE8UML789zUO9vVOI0emBmf:Zx6SsoOa/A3lRsUbbxnlGUOdb0emBmf

    • Guloader family

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      cf85183b87314359488b850f9e97a698

    • SHA1

      6b6c790037eec7ebea4d05590359cb4473f19aea

    • SHA256

      3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

    • SHA512

      fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

    • SSDEEP

      96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug

    Score
    8/10
    • Downloads MZ/PE file

MITRE ATT&CK Enterprise v15

Tasks