vipkeylogger

General

Target
5070e86affc342c1ffec45d8da18cf12b763e96ecd1ffeead79e4dfd451527ae.exe
Size 1.0MB
Sample250310-pee4natzcs
SHA256 5070e86affc342c1ffec45d8da18cf12b763e96ecd1ffeead79e4dfd451527ae
MD5 76b48938a8e80f35722492d27c967d24
SHA1 6ecafc31e56430c925a635cd1337fe65092fd00d
SHA512 9ec85ac7f4f98b129cb901f53bcca97df42a4b4fea88974216e9ad582150b8d843711fdce55c0ea8ffaedcead76709b0b71fc7f20693849070abb3a9d329326a
SSDEEP 24576:Glsk2uZOa3xtl4RfQxsrDksAexGMSOA/AkEj6cSYYaJ1aRk:GtPlMMsrDsMqAk8T1a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7552206830:AAGZUrvJgSRgT_tfVCG5NR-NdC35UuRR1yg/sendMessage?chat_id=6357516296

Targets

- Target
  5070e86affc342c1ffec45d8da18cf12b763e96ecd1ffeead79e4dfd451527ae.exe
- Size 1.0MB
- SHA256 5070e86affc342c1ffec45d8da18cf12b763e96ecd1ffeead79e4dfd451527ae
- MD5 76b48938a8e80f35722492d27c967d24
- SHA1 6ecafc31e56430c925a635cd1337fe65092fd00d
- SHA512 9ec85ac7f4f98b129cb901f53bcca97df42a4b4fea88974216e9ad582150b8d843711fdce55c0ea8ffaedcead76709b0b71fc7f20693849070abb3a9d329326a
- SSDEEP 24576:Glsk2uZOa3xtl4RfQxsrDksAexGMSOA/AkEj6cSYYaJ1aRk:GtPlMMsrDsMqAk8T1a
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery vipkeylogger keylogger stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Vipkeylogger family

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2