vipkeylogger | d9f0657f90a19e5454801cfdf540afd05bd29c54833e44650a1606bb18750fc2

General

Target
d9f0657f90a19e5454801cfdf540afd05bd29c54833e44650a1606bb18750fc2.exe
Size 1.1MB
Sample260712-1f33naa18y
SHA256 d9f0657f90a19e5454801cfdf540afd05bd29c54833e44650a1606bb18750fc2
MD5 53fd8ac120ba0356434a217cf65f05af
SHA1 9bce86aec498b47e106e12b5d26b4414c7ac6757
SHA512 9af348ce811774955dbfaf5f371d28165da5f27130ec857768357b9dcbc3bf106b1bddf8dc07d1a4c56352fa51730275bbeb47fbc81c121c0a921f5ac163b2f8
SSDEEP 24576:ztb20pkaCqT5TBWgNQ7aBEwG2FLJ/3V5yX6A:wVg5tQ7aBEwGULJ/45
TLSH
T1F735CF1363DDC361C7725273BA26B701AEBB782506A5F96B2FD4093DF820122525EB73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7453273782:AAF-FGPFIBHEHkCYUdocJNrwN0X_4m81mTw/sendMessage?chat_id=1443320838

Targets

- Target
  d9f0657f90a19e5454801cfdf540afd05bd29c54833e44650a1606bb18750fc2.exe
- Size 1.1MB
- SHA256 d9f0657f90a19e5454801cfdf540afd05bd29c54833e44650a1606bb18750fc2
- MD5 53fd8ac120ba0356434a217cf65f05af
- SHA1 9bce86aec498b47e106e12b5d26b4414c7ac6757
- SHA512 9af348ce811774955dbfaf5f371d28165da5f27130ec857768357b9dcbc3bf106b1bddf8dc07d1a4c56352fa51730275bbeb47fbc81c121c0a921f5ac163b2f8
- SSDEEP 24576:ztb20pkaCqT5TBWgNQ7aBEwG2FLJ/3V5yX6A:wVg5tQ7aBEwGULJ/45
- TLSH
  T1F735CF1363DDC361C7725273BA26B701AEBB782506A5F96B2FD4093DF820122525EB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery vipkeylogger keylogger stealer
- Family: VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Drops startup file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: VIPKeylogger

Drops startup file

Executes dropped EXE

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2