Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2420-17-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2420-17-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win10v2004-20250314-en
General
-
Target
2420-17-0x0000000000400000-0x0000000000448000-memory.dmp
-
Size
288KB
-
MD5
92cf8888641a23450fcb6ee898815210
-
SHA1
8f8ab20c681675ab39b5df5a4953d213591de0b6
-
SHA256
d0471dc1e807c00e7dde0b80e17c409c2e76cdf8af4b832881cddc5a8f2c373c
-
SHA512
4173b39215f73b69927e8757647edb6f491da4958ba3e9935ce2ee3bd25866f27e3b9cf77c8d84871bde5ccfdf21f5de5f2e710680a73dea55846cb865a3fbb5
-
SSDEEP
3072:DaXETsdsFfluhrdcZXdfvuWUF/z2SLj3U10dKQnVb2QfDs04ZY/VgaiHbbY:by2Hy1nVb2llb
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.wxtp.store - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@@ - Email To:
[email protected]
Signatures
-
Vipkeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2420-17-0x0000000000400000-0x0000000000448000-memory.dmp
Files
-
2420-17-0x0000000000400000-0x0000000000448000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 262KB - Virtual size: 262KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ