General
-
Target
25022025_0703_24022025_询价 (PO 345378).rar
-
Size
491KB
-
Sample
250225-hvh2xsvpx9
-
MD5
a9bff1671183f94efb8892018dacbb39
-
SHA1
994a13ad344b05512e59841ff4bf51371519b5f2
-
SHA256
35c70fc477e1863a8fd12c8b2f4a646cb85742258bf3dd3667be938a9e22a626
-
SHA512
7adf87ae7b82e17ff9b4d8767423fa93ab455558472bdd6e89352eed43f2b0d67f5ad101276d7ece70f6a06490378e1d31a3135cd6589d9732db1c4964ac621e
-
SSDEEP
12288:NRKC1qboX5Dnx0DN7srf7XolTBlYD73flXDpM4caG:NQ4rXhx0DN+zYlfKf9t32
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
ifSg^KL6 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
ifSg^KL6
Targets
-
-
Target
询价 (PO 345378).exe
-
Size
978KB
-
MD5
d644d6826806f4576e3e4b81e0564a20
-
SHA1
d51f44bb9644ca2c0bedc2ab78796131b6969a80
-
SHA256
bc2bb9a71331933d49cdf01b99bdca9e5aabfa26e883db0d09bc23c5c58983ad
-
SHA512
a10977190477cb38f61e1921c1c988c39d62860d24f194a96d5ec3b7b4dac21d80b989edf9cc0aa389be6d2ae78b37016785572cddca0ae013a9440c8dcddf4d
-
SSDEEP
24576:7u6J33O0c+JY5UZ+XC0kGso6Fa+FyNIeAKipWY:1u0c++OCvkGs9Fa+FyKwLY
Score10/10-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-