Overview

overview

10

Static

static

5

(STC) Tax ...EV.exe

windows7-x64

10

(STC) Tax ...EV.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    STCTaxInvoice25030216_REV.zip

  • Size

    615KB

  • Sample

    250328-qs3ybawxgx

  • MD5

    10ce5eeea2c3f4e6657dd222a259bcd7

  • SHA1

    22975e57cea8186e5c7fbd8a0fd76b20ab3c82bb

  • SHA256

    de6dc190ae7ed33e5e263beeb357b1cc0d413a44a346603b9cd7f6b40df3fe18

  • SHA512

    3cbdef412b0d4bdd900be5e6cbf7f7451fd5f8c12161ffeae1ffc25b2f9631c9ce42e1bf2969cc833df680f48c0302c50a86302a60fffa1491c67720b3f8bffa

  • SSDEEP

    12288:CcxJrK4gx8GuKh0SmhX9SOnYSzMFZ7DjsSILSiI0BZTj:CwrK4JX62KOYSzMkSdv0DTj

Score
10/10
vipkeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7332888932:AAEd0xO46FUg-eZu8OorYiVnZ_y4D9P2pCE/sendMessage?chat_id=7128988401

Targets

    • Target

      (STC) Tax Invoice 25030216_REV.exe

    • Size

      1023KB

    • MD5

      1f2316cbbb6f340ea45753ea5c889f11

    • SHA1

      3b49e0d165f9be0ac0443fa75ce4dcd25901dbcf

    • SHA256

      81f89461fc1feee34ad39a56fb386ed8e65eabe13416a20baa5b7adc6593e138

    • SHA512

      2c20d1fa92ac69af1f9757681dd06ae06379ba329df79bd4c14b6b04b7797a697884f0693388259481c0c3db0bf4597c845133c18902296a53804b7b59ddcc4a

    • SSDEEP

      24576:eu6J33O0c+JY5UZ+XC0kGso6FarIr1i3t07aEWY:wu0c++OCvkGs9FarZ3t0gY

    Score
    10/10
    vipkeyloggercollectiondiscoverykeyloggerstealer

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks