General

  • Target

    d9f5437f1b4cf3662a47d1234cf3ef5d7d6e6d657306f6c8970e463f6016e32f.exe

  • Size

    271KB

  • Sample

    250219-gglp8azrt6

  • MD5

    ebebf7dfcfb35a9c2d66c4cd8842ed7f

  • SHA1

    cfc48332791e50ad3dd2ba09ab43b31c69e3a2fe

  • SHA256

    d9f5437f1b4cf3662a47d1234cf3ef5d7d6e6d657306f6c8970e463f6016e32f

  • SHA512

    58907b27f0347b8744a3e83a4fab0a4bffd6fdbc11a751655cbe618ca06e2f241bb7c82bf198085c37bd6c35a6f4239abb66be19079e301e343d1d6b8821db81

  • SSDEEP

    3072:wEtvwV6Jm/j/xI3DRuvbnr9EUkmZV597Z7JHaVSb7r/8soYZYTVgfi2bbY:ALjrDkSbRXb

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    turkey.ipchina163.COM
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    &#!T=3]}zHGa

Targets

    • Target

      d9f5437f1b4cf3662a47d1234cf3ef5d7d6e6d657306f6c8970e463f6016e32f.exe

    • Size

      271KB

    • MD5

      ebebf7dfcfb35a9c2d66c4cd8842ed7f

    • SHA1

      cfc48332791e50ad3dd2ba09ab43b31c69e3a2fe

    • SHA256

      d9f5437f1b4cf3662a47d1234cf3ef5d7d6e6d657306f6c8970e463f6016e32f

    • SHA512

      58907b27f0347b8744a3e83a4fab0a4bffd6fdbc11a751655cbe618ca06e2f241bb7c82bf198085c37bd6c35a6f4239abb66be19079e301e343d1d6b8821db81

    • SSDEEP

      3072:wEtvwV6Jm/j/xI3DRuvbnr9EUkmZV597Z7JHaVSb7r/8soYZYTVgfi2bbY:ALjrDkSbRXb

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks