vipkeylogger

General

Target
2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69.exe
Size 999KB
Sample250812-v2bmmstvds
SHA256 2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
MD5 94d673f92eb01990e9b19cbe354850f7
SHA1 024177713582f0d673ae649a46d93a39b3b87055
SHA512 7edad90e255965abcc5cb7a597b8fbb7f5c271ce3100490ad78b9255b19f155f5aab46a67e5258b5aa4b2a6671858739237744454be3d5c6f452846695e44bbe
SSDEEP 24576:ztb20pkaCqT5TBWgNQ7aGFzINUDbMN6A:wVg5tQ7aGFdk5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.saleo-gomel.by
Port
587
Username
[email protected]
Password
Q_gidroadmin_2014

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.saleo-gomel.by
Port
587
Username
[email protected]
Password
Q_gidroadmin_2014
Email to
[email protected]

Targets

- Target
  2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69.exe
- Size 999KB
- SHA256 2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
- MD5 94d673f92eb01990e9b19cbe354850f7
- SHA1 024177713582f0d673ae649a46d93a39b3b87055
- SHA512 7edad90e255965abcc5cb7a597b8fbb7f5c271ce3100490ad78b9255b19f155f5aab46a67e5258b5aa4b2a6671858739237744454be3d5c6f452846695e44bbe
- SSDEEP 24576:ztb20pkaCqT5TBWgNQ7aGFzINUDbMN6A:wVg5tQ7aGFdk5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

vipkeylogger collection discovery keylogger stealer
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Vipkeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2