Analysis
-
max time kernel
112s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
14/04/2025, 15:02
General
-
Target
Recibos.exe
-
Size
681KB
-
MD5
3203fe67417ccd0ba749ceb720f680e9
-
SHA1
343a8c2ac8ae34afc1b343490d256943021f08d1
-
SHA256
1b3b9f0c7a82fa5f4e656376d971581211ba332c7857ee114365fecca818b863
-
SHA512
c2c3c9e2415bd0abd3db236c72613635a4054cf014fef54d72e48de7bcc169041b6b8d551cf06c07c9dd985c59e2de1eaec436befa443768940bcdfc52fb0521
-
SSDEEP
12288:q+qkDlXDwOiNuB2WPFwl5Lmpb3vliE4mCeuiBnKINft1AN:q+qkBwhNoVqHmtfCmCeHPNF1AN
Malware Config
Extracted
Protocol: smtp- Host:
botellaconsultant.com - Port:
587 - Username:
[email protected] - Password:
gab@06012019
Extracted
vipkeylogger
Protocol: smtp- Host:
botellaconsultant.com - Port:
587 - Username:
[email protected] - Password:
gab@06012019 - Email To:
[email protected]
https://api.telegram.org/bot8177269356:AAE1A-wrzIPPvS7h0Q2cLoj1CThwbRU3Yas/sendMessage?chat_id=7267131103
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recibos.exe"C:\Users\Admin\AppData\Local\Temp\Recibos.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Recibos.exe"C:\Users\Admin\AppData\Local\Temp\Recibos.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
56B
MD59fd6cde03f44744e40ad1052fe923bce
SHA1ade1a22e886b9fe5b22a340f17b58c08fb5a16da
SHA25623dd38f956f3c3c7b7c53352e1fd05fa7c74d4bacaa7f2f943b38b60bb199d9e
SHA5125aada101fc6749ab0bedb8a17997a83b7ad6f111ab8560c230b3479b6ad6ce6822691a3eab832b1a60403726e5ff7f28587a20a7ead27a75790e7ea0d87e49f7
-
Filesize
4B
MD5cde63b34c142af0a38cbe83791c964f8
SHA1ece2b194b486118b40ad12c1f0e9425dd0672424
SHA25665e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d
SHA5120559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c
-
Filesize
68B
MD5acc8e2dc8ef177e828af296be96c6a4e
SHA17cc55fd8ac9beeedff4b42acbe7a99d0559f178c
SHA256860e81e337b378b1d03c4f9205ef876d901e44758d7068a43f7d80eaec9c59aa
SHA512ba120dda31785f9ff6d9c4ba55eee99c8c0fffa7cc84afac054387da49dd5085e454996a4acd9018cfb4eea887e7610b6265533b9be8bbb2c5063ed071bb9e33
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
21B
MD58971b7a691c3fa70cb038019ee564845
SHA1bdffd99c78750e7832d7d1e0cdee6c08c089ecb5
SHA256612365d1000c11e69ee5ecd1faa7dc59078993959c48b7916a580b7bd3cbf587
SHA512ee51ddd485220a130dbd4ae28f47f7bb990ca989deaabd5467b2f446cba05b2e600e1c04414e844c94bdc0b68bdfc2618e8aa410401cbb640c59831b8f9647d9
-
Filesize
65B
MD51bd5509d17a385dbcebec5b71de8dffc
SHA19d70c3f205dddda5e33e5de97c0a09feb6836130
SHA2562bad3065546719b1e5ff58cb7ca6231b6cb669fb1fd06fb30102e9df00d63e60
SHA512ca43f9d62ad2c3b950b816274869a1c0bd22b77bbb80fc810783ef23b9317362132fb2f29510bb51f4d00940d8c9038b5700560b6f1e38722b2e65037c148bbf
-
Filesize
60B
MD5ba3e888ad97b8bf3fc0e20a95a689988
SHA1a1a040304b8a08ce555a2ff635d808f935fdd8b5
SHA256ed8dcce5089b966bf7c29610daac67f24735587c740b68d4ccce60fe7d7b7438
SHA51201f0d4118b8bb4f3267cf277fa9af23202d0e35b27530c8dbd2e696666b33f4030114558dc2fe2d1d5ed7b769f2aec9060dc172a5940ce11d6425b2a7420a08d
-
Filesize
12KB
MD59b38a1b07a0ebc5c7e59e63346ecc2db
SHA197332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA2568b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
SHA51226e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
18.3MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
72.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
72.4MB
-
Filesize
296KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB