vipkeylogger

General

Target
COMMERCIAL INVOICE-0125649.exe
Size 1.3MB
Sample250326-lsb3da1wbt
SHA256 12d1e667249b08f89e4ee20b883da8d2496b5221bb0d4241bcc933aa8146ada7
MD5 e5daebb3ae95ef647abae065c439cd3f
SHA1 40a9a3d08bbcf8781858bca10560cd049c6b2415
SHA512 27d85798b3aa7e61c197365ab271cb6659f334895e6be4264973e4cf9270bfff3563c5a3e58b18496491142b7317d91c01ecd3a91ec37934d459972b0a11c30b
SSDEEP 24576:eAZBbTOOFGoKtlGO9oFSN+yiQ7srt1JD6pOSsSSBy:eSVTOIGoKtCFb6kt3LvSwy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.iaa-airferight.com
Port
25
Username
[email protected]
Password
moneyismade22
Email to
[email protected]

Targets

- Target
  COMMERCIAL INVOICE-0125649.exe
- Size 1.3MB
- SHA256 12d1e667249b08f89e4ee20b883da8d2496b5221bb0d4241bcc933aa8146ada7
- MD5 e5daebb3ae95ef647abae065c439cd3f
- SHA1 40a9a3d08bbcf8781858bca10560cd049c6b2415
- SHA512 27d85798b3aa7e61c197365ab271cb6659f334895e6be4264973e4cf9270bfff3563c5a3e58b18496491142b7317d91c01ecd3a91ec37934d459972b0a11c30b
- SSDEEP 24576:eAZBbTOOFGoKtlGO9oFSN+yiQ7srt1JD6pOSsSSBy:eSVTOIGoKtCFb6kt3LvSwy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery vipkeylogger collection keylogger stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Vipkeylogger family

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2