General

  • Target

    1d66e19010e84c28b72a51a512fbb9fd68bf3818d52bd837c0a51c854a1bb3b0

  • Size

    699KB

  • Sample

    250415-f1m7qasxfw

  • MD5

    fb8f106455fd8044402a8155e205157e

  • SHA1

    4edd0483849131b8bb6a739f17d73bfcaddd4be0

  • SHA256

    1d66e19010e84c28b72a51a512fbb9fd68bf3818d52bd837c0a51c854a1bb3b0

  • SHA512

    a59e8174e1251cab5b8ac03bad6573fa1da78439e7bc07ffc2144ec177310d7c2184cc2fd8739ec372cbb697388d8f7fdac099e2f3739a9274912357128604d8

  • SSDEEP

    12288:Oh5FOzL1mJhj8aRby51p+7rCA656MD8s7UHtPHwLzntNr8gwlkwqj:Oh52YeSyQ7rCt5V8swFH87rLwlVqj

Malware Config

Extracted

Family

vipkeylogger

Targets

    • Target

      my_cv_94475_105.exe

    • Size

      1.1MB

    • MD5

      8fea93f8083a6e8d05c17f070331cba1

    • SHA1

      ed06a1b513c6aeb35ce71714b888a7790b138b87

    • SHA256

      52ec7527de4f053432bd4ec476453d905534a774f88d46b15b721b72f4384cf2

    • SHA512

      2dff1105a386fc523bcd46b711bca97d864864b07975c7855f7cb36da183ad447cd205beec5539455de017890754acc2aed41a605ec8b09cbb027cf51c135fa7

    • SSDEEP

      24576:Eu6J33O0c+JY5UZ+XC0kGso6Fa0R58+w5x8/vLwxuWY:+u0c++OCvkGs9Fa0Ri+wH5jY

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks