vipkeylogger | b53cfa10422ebf9800b200a7f3ab4bb84595255f739dc13c74a9eb9905803fc2

General

Target
b53cfa10422ebf9800b200a7f3ab4bb84595255f739dc13c74a9eb9905803fc2.exe
Size 1.1MB
Sample260712-1ckf5sg17n
SHA256 b53cfa10422ebf9800b200a7f3ab4bb84595255f739dc13c74a9eb9905803fc2
MD5 ef1da07dffc53e1b8812ecbd458b9180
SHA1 dedbbd91bfec2c6b4c8ecf162c85c4c050cb9bcf
SHA512 0606b9439a627bfbbba75362f8ecdac5a5104c54ed7a23a3c5ebd6427f78c22905aa36aab2e9f99b35713eedf2303762c76eec452197a34653691056b840a997
SSDEEP 24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaj84E2ygHPGto5rt9:tPVt/LZeJbInQRaj8F2ygx
TLSH
T14A45BF027391C062FFAB91334B5AF6115BBC79260123AA1F13981DB9FE705B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

Targets

- Target
  b53cfa10422ebf9800b200a7f3ab4bb84595255f739dc13c74a9eb9905803fc2.exe
- Size 1.1MB
- SHA256 b53cfa10422ebf9800b200a7f3ab4bb84595255f739dc13c74a9eb9905803fc2
- MD5 ef1da07dffc53e1b8812ecbd458b9180
- SHA1 dedbbd91bfec2c6b4c8ecf162c85c4c050cb9bcf
- SHA512 0606b9439a627bfbbba75362f8ecdac5a5104c54ed7a23a3c5ebd6427f78c22905aa36aab2e9f99b35713eedf2303762c76eec452197a34653691056b840a997
- SSDEEP 24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaj84E2ygHPGto5rt9:tPVt/LZeJbInQRaj8F2ygx
- TLSH
  T14A45BF027391C062FFAB91334B5AF6115BBC79260123AA1F13981DB9FE705B1563E7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery vipkeylogger keylogger stealer
- Family: VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Drops startup file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: VIPKeylogger

Drops startup file

Executes dropped EXE

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2