Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

Payroll List.exe

windows7-x64

10

Payroll List.exe

windows10-2004-x64

10

Resubmissions

28/03/2025, 02:42

250328-c7a9yssrz3 10

28/03/2025, 02:36

250328-c32w4s1tey 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    061e83ad8b13e285fedf59eee385091cbdd9d269f33809859cf95e79e3209765

  • Size

    521KB

  • Sample

    250328-c32w4s1tey

  • MD5

    1d21a91da175265d6d6fff5878909d71

  • SHA1

    b1a0ff75966da1a543f00d0b8209d77ff3904ebb

  • SHA256

    061e83ad8b13e285fedf59eee385091cbdd9d269f33809859cf95e79e3209765

  • SHA512

    ed06fd6c55b3217fea8f811e710ef1c42d21c9d6bd82ec306067cf3a4d693db041ec42920c4e97da562d23e1d9626467f395336ca88d20a43f864cff498ef6b9

  • SSDEEP

    12288:lbpPyZaqz3kMqAK4D5prONc4aSiE7+YoK7QZF:lbpcaqjkMVKQZT4aaRo/P

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8089350393:AAGtBAwUH6SGnhWUaMF4LZ_wf4asnjV0ZLY/sendMessage?chat_id=7839951264

Targets

    • Target

      Payroll List.exe

    • Size

      1.0MB

    • MD5

      13c442d8b8f4b6039b92e9beabaed96c

    • SHA1

      00e5f09a57064338f1db88298f31c50d853aca9e

    • SHA256

      aa21fca827d1d73cfc4f1153945a1534a66240e396ba3f9b361b6bd80aa31023

    • SHA512

      f44f42b5847530e647cf556fa2f014bd163d2657185b3ea6819fa95c2dae4a2ac7abaf4ca6f43ef259c6f1de15e9c4c87b0a7ba015aa6c07eb17e7b00544b97c

    • SSDEEP

      24576:Du6J33O0c+JY5UZ+XC0kGso6Faj1bcFSonuDiWY:Nu0c++OCvkGs9FapbbocY

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks