General
- Target 0db7329cd9ec4fc92e41092071fc84576d78019f7c7c6778f75eb55487da07f9
- Size 692KB
- Sample250701-e6hnraz1ht
- SHA256 0db7329cd9ec4fc92e41092071fc84576d78019f7c7c6778f75eb55487da07f9
- MD5 87080db93d693606cf2e25d9a4ecc7d6
- SHA1 4c6ad35076e6f8104c7ae429934bfccd2ca8ac32
- SHA512 099846ddf9cf6be973925162626737ecdeab8804c53aa828173468f2523add48aa90ae4d084b10c884e4756711d1cb3f1b3399f95b76fca7cd22178a775eff50
- SSDEEP 12288:gMCvVVK8F/lE1fvr1J4tsVboSuzavk9ysBnC3JLlOUYxOJFc/qbfMiW:fCvfXE17v4aKcZgC3xk9EFAq+
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
kindly quote your best price for the listed goods..exe
Resource
win10v2004-20250619-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
kindly quote your best price for the listed goods..exe
Resource
win11-20250619-en
15 signatures
150 seconds
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.aktagor-prom.by
-
Port
587
-
Username
-
Password
RC84pv9H2*F
Extracted
Family
-
vipkeylogger
Credentials
-
Protocol
smtp
-
Host
mail.aktagor-prom.by
-
Port
587
-
Username
-
Password
RC84pv9H2*F
-
Email to
Targets
-
- Target kindly quote your best price for the listed goods..exe
- Size 763KB
- SHA256 62189b25fc1d9278b2382de2478835111bb016004d383b2884dcf6ed19d17933
- MD5 668d73ce07fae36076859ecfb9ee11b2
- SHA1 b4499a5ee979f863d02be1e307652505b0a1b2f6
- SHA512 866eb4a28d522c756fb458a7557731204022d55c67f3ab03760152976a98c5c16a4f2261bb265bf4d6b1b68810e5f89e6040a4cf122742b782f597713fad6951
- SSDEEP 12288:ET+iZMeKlE1/vPZJ+tsfboAuzqvA+EXEf97Tr+54JIJoE5ScUYtOvFc/7VTIPjU4:siE1fT+a8sA+ds4JIKE5hR0FAF8jUDJ
- MD5 SHA1 SHA512 SSDEEP
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext