vipkeylogger

General

Target

AWB#5305323204643.exe
Size

1.3MB
Sample

250228-g8zfdss1az
MD5

f7979f9059fea1ba99990d0dbf0be034
SHA1

fbb9fdf6571b1ab4d6f3338e412bb852f791c3e5
SHA256

728ecae4c2085d8050b5228cb0246aeb67c3eba6115847a6fe6b2caab6220b12
SHA512

c63eb04ca44cd11607f0f2ccd5b1b7a1814c60517207c57addf4af6498d46def1debfc48cc53f16331cb840c96bb5d5d8c46093b7f9373fbd871c22d41e853ed
SSDEEP

24576:tAzOg/JQyeOe3VLhqHNH6hz8Q+GGuJqMdnaQA+FWxa2k3/VLfB0r555:pg/JQ1OqhGlE1neQWlk3tLf+

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7552206830:AAGZUrvJgSRgT_tfVCG5NR-NdC35UuRR1yg/sendMessage?chat_id=6357516296

Targets

- Target
  
  AWB#5305323204643.exe
- Size
  
  1.3MB
- MD5
  
  f7979f9059fea1ba99990d0dbf0be034
- SHA1
  
  fbb9fdf6571b1ab4d6f3338e412bb852f791c3e5
- SHA256
  
  728ecae4c2085d8050b5228cb0246aeb67c3eba6115847a6fe6b2caab6220b12
- SHA512
  
  c63eb04ca44cd11607f0f2ccd5b1b7a1814c60517207c57addf4af6498d46def1debfc48cc53f16331cb840c96bb5d5d8c46093b7f9373fbd871c22d41e853ed
- SSDEEP
  
  24576:tAzOg/JQyeOe3VLhqHNH6hz8Q+GGuJqMdnaQA+FWxa2k3/VLfB0r555:pg/JQ1OqhGlE1neQWlk3tLf+
Score

10^/10

discovery vipkeylogger collection keylogger stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Vipkeylogger family

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2