Behavioral task
behavioral1
Sample
4748-585-0x0000000000460000-0x00000000004AA000-memory.exe
Resource
win10v2004-20250314-en
General
-
Target
4748-585-0x0000000000460000-0x00000000004AA000-memory.dmp
-
Size
296KB
-
MD5
620c7d043fd77f9066a679422b8d5ac0
-
SHA1
9d8e43349134b9e460aa15794d2e729dbc493870
-
SHA256
32c14c6754f08ce226cba64452c528768981094ba373f7558db45d39bee208bf
-
SHA512
8f88469c2487186fe8bd6739cd1ced6483301c9ff9d307e28f14b730b75fb0f2acfbc596b037a47d2a7c8679003f1c7d4519a817f0513e3a6b28989b75cd72b9
-
SSDEEP
3072:cTgjT4bkKlGloZg320YFSr4KFJhugiGitZ9KBAcb2FGYPfq/b7BTZsjLrYTVgfix:WkSkitZuATfQbluTb
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7670096613:AAEY0JFb0a1CzByXhvZqUC9W4CQmo9fAmZM/sendMessage?chat_id=7911627152
Signatures
-
Vipkeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4748-585-0x0000000000460000-0x00000000004AA000-memory.dmp
Files
-
4748-585-0x0000000000460000-0x00000000004AA000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ