General
-
Target
173986194367d5b010c726a273e684c444fad68035ad95510fd3cc50d0c4ea18ad11b83de8491.dat-decoded.exe
-
Size
271KB
-
Sample
250218-kxfexsyrak
-
MD5
f169e40b1927b27382bbd7ecce15a678
-
SHA1
466ba98d8e9066512c35a9643c50493313d8527c
-
SHA256
e9ef4ecd05b0501922a144039d8e539bf6255d39248327202e2c4ce992cb796e
-
SHA512
93e72a28e8a7f9a4a31ce6599a79147ce14419494d1c60accd3e62b1541311d405b67a64f3d49f3310b343b106bb923d4640acf74ab911108627f968103bdd13
-
SSDEEP
3072:IDh9znVTCFHyQyT4PT8Af/PrFfEPT5A5e9bJGrhxc61b7/9Liso4ZYTVgfiWbbY:0h49J8/gd1bT9Ln3b
Behavioral task
behavioral1
Sample
173986194367d5b010c726a273e684c444fad68035ad95510fd3cc50d0c4ea18ad11b83de8491.dat-decoded.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
173986194367d5b010c726a273e684c444fad68035ad95510fd3cc50d0c4ea18ad11b83de8491.dat-decoded.exe
Resource
win10v2004-20250217-en
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
turkey.ipchina163.com - Port:
587 - Username:
[email protected] - Password:
!YxP!%1gFh=G - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
turkey.ipchina163.com - Port:
587 - Username:
[email protected] - Password:
!YxP!%1gFh=G
Targets
-
-
Target
173986194367d5b010c726a273e684c444fad68035ad95510fd3cc50d0c4ea18ad11b83de8491.dat-decoded.exe
-
Size
271KB
-
MD5
f169e40b1927b27382bbd7ecce15a678
-
SHA1
466ba98d8e9066512c35a9643c50493313d8527c
-
SHA256
e9ef4ecd05b0501922a144039d8e539bf6255d39248327202e2c4ce992cb796e
-
SHA512
93e72a28e8a7f9a4a31ce6599a79147ce14419494d1c60accd3e62b1541311d405b67a64f3d49f3310b343b106bb923d4640acf74ab911108627f968103bdd13
-
SSDEEP
3072:IDh9znVTCFHyQyT4PT8Af/PrFfEPT5A5e9bJGrhxc61b7/9Liso4ZYTVgfiWbbY:0h49J8/gd1bT9Ln3b
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-