General

  • Target

    173986194367d5b010c726a273e684c444fad68035ad95510fd3cc50d0c4ea18ad11b83de8491.dat-decoded.exe

  • Size

    271KB

  • Sample

    250218-kxfexsyrak

  • MD5

    f169e40b1927b27382bbd7ecce15a678

  • SHA1

    466ba98d8e9066512c35a9643c50493313d8527c

  • SHA256

    e9ef4ecd05b0501922a144039d8e539bf6255d39248327202e2c4ce992cb796e

  • SHA512

    93e72a28e8a7f9a4a31ce6599a79147ce14419494d1c60accd3e62b1541311d405b67a64f3d49f3310b343b106bb923d4640acf74ab911108627f968103bdd13

  • SSDEEP

    3072:IDh9znVTCFHyQyT4PT8Af/PrFfEPT5A5e9bJGrhxc61b7/9Liso4ZYTVgfiWbbY:0h49J8/gd1bT9Ln3b

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    turkey.ipchina163.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    !YxP!%1gFh=G

Targets

    • Target

      173986194367d5b010c726a273e684c444fad68035ad95510fd3cc50d0c4ea18ad11b83de8491.dat-decoded.exe

    • Size

      271KB

    • MD5

      f169e40b1927b27382bbd7ecce15a678

    • SHA1

      466ba98d8e9066512c35a9643c50493313d8527c

    • SHA256

      e9ef4ecd05b0501922a144039d8e539bf6255d39248327202e2c4ce992cb796e

    • SHA512

      93e72a28e8a7f9a4a31ce6599a79147ce14419494d1c60accd3e62b1541311d405b67a64f3d49f3310b343b106bb923d4640acf74ab911108627f968103bdd13

    • SSDEEP

      3072:IDh9znVTCFHyQyT4PT8Af/PrFfEPT5A5e9bJGrhxc61b7/9Liso4ZYTVgfiWbbY:0h49J8/gd1bT9Ln3b

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks