vipkeylogger

General

Target
UGQ.zip
Size 602KB
Sample250723-mdds4avydz
SHA256 559949a55b9fbdf50358888ab5a24c8b7288adecf08d6889bc440cb95d64c091
MD5 936209aa4c53ba9d7352c34feb9103f8
SHA1 933060b8589e7cacd46021d109b556af5b0694ff
SHA512 04147e49257fcffe3d1894c882f1e409a9045757896e63fd95f6f5e5fcf35a7ffa68b3decd1333b87afa122351be709ab4b015f2f5249851a7cd3ecee19651a2
SSDEEP 12288:i2yKdKBPVH1dmcCu2vgvZ0V9cgCwY+JMuWiim3I4w0bYM:i2yKImBUa9y9E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sarahfoils.com
Port
587
Username
[email protected]
Password
Scalatica01

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.sarahfoils.com
Port
587
Username
[email protected]
Password
Scalatica01
Email to
[email protected]

C2

https://api.telegram.org/bot7829436438:AAFBKlvdQ5huGp7m9NIN0zMfR9uls6YtDUg /sendMessage?chat_id=7886581547

Targets

- Target
  UGQ.exe
- Size 1.1MB
- SHA256 624f46db29045d2f0a16dd88f64ba2503febaadb7f0b721df054bbe7dbad23e9
- MD5 a032d27d8a7ddb20119614462eafd4c8
- SHA1 276f8e0fae648f1ba5e493c2aa2d2e2b518f8f0a
- SHA512 8bfc499beaeab490814f6985d622d201031a14e54df10b7103e2c9876eafcd5401c24a982968bfdd174e6ab6f02c2e337fc014f372d0f7ad46b3f3a8638478a2
- SSDEEP 12288:+tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgahP7r9r/+pppppppppp4:+tb20pkaCqT5TBWgNQ7ah1QD7236A
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

vipkeylogger collection discovery keylogger stealer
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Vipkeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2