General

  • Target

    e37bc4d9a080a4bd5cff437dddb5b8a8d2236373e7c6eb3940445befca6c3f88.exe

  • Size

    267KB

  • Sample

    250219-gl67qa1jw8

  • MD5

    bceb040673584fa919d1c23fc7e73973

  • SHA1

    d236187e78f2562daed6f51e816104da9ef53d30

  • SHA256

    e37bc4d9a080a4bd5cff437dddb5b8a8d2236373e7c6eb3940445befca6c3f88

  • SHA512

    2a7701919b92c4e9c0a5cbe6b2a5d6d70a1c41f058aa4fcabe9a4da57fbe71653fba9fc02a02010202b028949009113ecf0076633dd70f057c7ae06c647360e2

  • SSDEEP

    6144:JVAok+iqszpV4onrwiPkpnkgvQIxDaO3HQXBoqn/0kyWWingbnVVb:3kRWvz

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    142.171.169.81
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    !z34db8K4

Targets

    • Target

      e37bc4d9a080a4bd5cff437dddb5b8a8d2236373e7c6eb3940445befca6c3f88.exe

    • Size

      267KB

    • MD5

      bceb040673584fa919d1c23fc7e73973

    • SHA1

      d236187e78f2562daed6f51e816104da9ef53d30

    • SHA256

      e37bc4d9a080a4bd5cff437dddb5b8a8d2236373e7c6eb3940445befca6c3f88

    • SHA512

      2a7701919b92c4e9c0a5cbe6b2a5d6d70a1c41f058aa4fcabe9a4da57fbe71653fba9fc02a02010202b028949009113ecf0076633dd70f057c7ae06c647360e2

    • SSDEEP

      6144:JVAok+iqszpV4onrwiPkpnkgvQIxDaO3HQXBoqn/0kyWWingbnVVb:3kRWvz

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks