General

  • Target

    60fb7826f156ee2fefc7a9bbf772b826f2cba708807865a83da935b561fb2e36

  • Size

    725KB

  • Sample

    250213-ta325szqgt

  • MD5

    5d8b6b805b154a1f397614a2571de5dd

  • SHA1

    2fc18b994186cb5e43fe2639f7b26a371d50eba8

  • SHA256

    60fb7826f156ee2fefc7a9bbf772b826f2cba708807865a83da935b561fb2e36

  • SHA512

    7ca0454fc50dc302b846ab6f8b83fa80c2b6404231d2da7f47bdd3930f716405e7c91fd0c1d281c3ff5cc82a43e6ce02948686b55e9d442b6054003279599355

  • SSDEEP

    12288:40ZaLMtOAOCHp0v1+egTR+m6XJkzx7igLGM2e/EtfYgTBuDHBshzcs2wUxRyIKLl:40jtOAOCJ0v1+egN+JKcSyNahUctHPzK

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8172976107:AAH5CXqEBGFF-CK18VpImdWAW7U_9296FqY/sendMessage?chat_id=6885960134

Targets

    • Target

      Limitarian.exe

    • Size

      740KB

    • MD5

      4fa38b05807f476d8ee68f21fd19bfe6

    • SHA1

      c2ff720a03224ac753db68f6af67b6893065c895

    • SHA256

      e9f5387c0d3930c8411a98a493979b3c0e1306d26deba3ff3d5a6ee9a36c0cc3

    • SHA512

      9a6196f8e143fb18a02987a2081437956203b49c27e6cc277387219e56e5e75d8b29d4bc15752ff10905cebc4d0f8d655e15e6b3e139a192bdb4d0040c474f7f

    • SSDEEP

      12288:NF9OIpstX2WZRreby38SeD83S1V2dt8IysxnE8UML789zUO9vVOI0emBmV:xOKsN5Rr53lRsVumIysxnlGUOdb0emB4

    • Guloader family

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      cf85183b87314359488b850f9e97a698

    • SHA1

      6b6c790037eec7ebea4d05590359cb4473f19aea

    • SHA256

      3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

    • SHA512

      fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

    • SSDEEP

      96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug

    Score
    8/10
    • Downloads MZ/PE file

MITRE ATT&CK Enterprise v15

Tasks