vipkeylogger | f6eb413e10a83ccf32477baf2c8d7d21c33e98a1b65755989487fbb5d941e6ff

General

Target
f6eb413e10a83ccf32477baf2c8d7d21c33e98a1b65755989487fbb5d941e6ff.exe
Size 980KB
Sample260608-ls4gmacv4w
SHA256 f6eb413e10a83ccf32477baf2c8d7d21c33e98a1b65755989487fbb5d941e6ff
MD5 7be96bbd87dae218a0662071c9ae0db6
SHA1 87c74894bdc0c790fddd518283e2b3731287a995
SHA512 594838442e31876e9f8ada07f07e073d0de6493dc8cd5bb8db3a82da2db2e5f0e7335c93db4b539b56a690985619b2dfdba1be51802a9299fc51a6b838aaf341
SSDEEP 24576:gosdFilM4zQlnMagHXBJeiY4feyr8TLDiNDRvr:8dFuMRllqXjVY4fezXkr
TLSH
T1F32523A479AEE11AC95A47BA09B2C33643354E68F521C3A7DEEDFCDF79257401824383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
hosting2.ro.hostsailor.com
Port
587
Username
[email protected]
Password
7213575aceACE@@
Email to
[email protected]

Targets

- Target
  f6eb413e10a83ccf32477baf2c8d7d21c33e98a1b65755989487fbb5d941e6ff.exe
- Size 980KB
- SHA256 f6eb413e10a83ccf32477baf2c8d7d21c33e98a1b65755989487fbb5d941e6ff
- MD5 7be96bbd87dae218a0662071c9ae0db6
- SHA1 87c74894bdc0c790fddd518283e2b3731287a995
- SHA512 594838442e31876e9f8ada07f07e073d0de6493dc8cd5bb8db3a82da2db2e5f0e7335c93db4b539b56a690985619b2dfdba1be51802a9299fc51a6b838aaf341
- SSDEEP 24576:gosdFilM4zQlnMagHXBJeiY4feyr8TLDiNDRvr:8dFuMRllqXjVY4fezXkr
- TLSH
  T1F32523A479AEE11AC95A47BA09B2C33643354E68F521C3A7DEEDFCDF79257401824383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery vipkeylogger keylogger stealer collection
- Family: VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: VIPKeylogger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

SmartAssembly .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2