General
-
Target
60fb7826f156ee2fefc7a9bbf772b826f2cba708807865a83da935b561fb2e36
-
Size
725KB
-
Sample
250213-ta325szqgt
-
MD5
5d8b6b805b154a1f397614a2571de5dd
-
SHA1
2fc18b994186cb5e43fe2639f7b26a371d50eba8
-
SHA256
60fb7826f156ee2fefc7a9bbf772b826f2cba708807865a83da935b561fb2e36
-
SHA512
7ca0454fc50dc302b846ab6f8b83fa80c2b6404231d2da7f47bdd3930f716405e7c91fd0c1d281c3ff5cc82a43e6ce02948686b55e9d442b6054003279599355
-
SSDEEP
12288:40ZaLMtOAOCHp0v1+egTR+m6XJkzx7igLGM2e/EtfYgTBuDHBshzcs2wUxRyIKLl:40jtOAOCJ0v1+egN+JKcSyNahUctHPzK
Static task
static1
Behavioral task
behavioral1
Sample
Limitarian.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Limitarian.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250211-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot8172976107:AAH5CXqEBGFF-CK18VpImdWAW7U_9296FqY/sendMessage?chat_id=6885960134
Targets
-
-
Target
Limitarian.exe
-
Size
740KB
-
MD5
4fa38b05807f476d8ee68f21fd19bfe6
-
SHA1
c2ff720a03224ac753db68f6af67b6893065c895
-
SHA256
e9f5387c0d3930c8411a98a493979b3c0e1306d26deba3ff3d5a6ee9a36c0cc3
-
SHA512
9a6196f8e143fb18a02987a2081437956203b49c27e6cc277387219e56e5e75d8b29d4bc15752ff10905cebc4d0f8d655e15e6b3e139a192bdb4d0040c474f7f
-
SSDEEP
12288:NF9OIpstX2WZRreby38SeD83S1V2dt8IysxnE8UML789zUO9vVOI0emBmV:xOKsN5Rr53lRsVumIysxnlGUOdb0emB4
-
Guloader family
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
cf85183b87314359488b850f9e97a698
-
SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea
-
SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
-
SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
-
SSDEEP
96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
Score8/10-
Downloads MZ/PE file
-