Overview

overview

10

Static

static

1

POAIR02207741.pdf.cmd

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    POAIR02207741.pdf.z

  • Size

    1.4MB

  • Sample

    250331-raenfa1wdz

  • MD5

    246b6790614f004783b74c53e2990a50

  • SHA1

    397c1b4577daef20ec45ff5362b55cfd9d23a180

  • SHA256

    106a569acf352524dc6e7d5dde93ff66022626dd534d0d5571297b08acaed313

  • SHA512

    27177f80d85892b43110ab8ef225ae5201899e541524f298261ef496e741cde7e47c7071ccdeed0d912b828314a0c715741ded6c0332304014c43bb55ce84991

  • SSDEEP

    24576:4CGidy9KLkSywJnkPhC6qCG6mLboB5uI/zF1oqDEG3HECzTaLPWCxdtrd0Kfi:4CnXFywl0C6qCQboLuAUb4HbzWTW0tM

Score
10/10
modiloadervipkeyloggercollectiondiscoveryexecutionkeyloggerpersistencestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.wotlers-gmbh.de
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    goodgood12345"

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7277207626:AAGRDtfhvqxeEEY9C2dcl-J2e8y-ub9ECYU/sendMessage?chat_id=7128988401

Targets

    • Target

      POAIR02207741.pdf.cmd

    • Size

      4.3MB

    • MD5

      fb8af934988b8e5aac730347b5bc5f77

    • SHA1

      8c346cd58efe5705f48b6f549832f4a17a78c417

    • SHA256

      a3937a50c4799407e216c587b904de4b952f8878090231e37c6b5b56eef41732

    • SHA512

      56a74a9d2a5cc3e0e34a73e66279a21de303dccefbbd1f5893bfaa6fcf2fd32e0c68693a231b4e6309133e95d228194e9c3de173c3f23dc14a070d1f4c7ff00b

    • SSDEEP

      49152:JbVKP1MDsjoT+QW/CKQLCgR2ZiwoHimSryF2PjA7E8:z

    Score
    10/10
    modiloadervipkeyloggercollectiondiscoveryexecutionkeyloggerpersistencestealertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • ModiLoader Second Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks