Overview

overview

10

Static

static

5

new inquir...00.exe

windows10-2004-x64

10

new inquir...00.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    new inquiries $1,710.000.exe
  • Size 576KB
  • Sample260224-c79grabt7e
  • SHA256 f5579aef87c24c6ff57e30c5d12ea0666343fcdd0f1f0af4c849c9caf53cb69b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vipkeyloggercollectiondiscoveryevasionkeyloggerstealertrojanupx

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.caesarsshippingintl.com
  • Port

    587
  • Username

    [email protected]
  • Password

    9Re4r#drif

Extracted

Family

  • vipkeylogger

Credentials

Targets

    • Target
      new inquiries $1,710.000.exe
    • Size 576KB
    • SHA256 f5579aef87c24c6ff57e30c5d12ea0666343fcdd0f1f0af4c849c9caf53cb69b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondiscoveryevasionvipkeyloggerkeyloggerstealertrojanupx

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks