vipkeylogger | 5a0b71ccda76fb56767bef9282ecafbe0385b28d1fa5ab611b80427cf75725fa

General

Target
c363e567a04e86db78f38568d6aad75186719deac66459276dbba3c458151e70.zip
Size 112KB
Sample260717-2xcgpscs4s
SHA256 5a0b71ccda76fb56767bef9282ecafbe0385b28d1fa5ab611b80427cf75725fa
MD5 e9279ef6668ad9d153b335d1505e599c
SHA1 a70be682d36df32fd395c5365673858cc0bdc44b
SHA512 a251e0ee92f8fc9cc51001cc810ed7670a3d613d55b45e55e8c6c38bd81d6237f072a916cbaf56ed6c5ab51fa19785b11be11209e0a4826a9f0ee19b1d6907e3
SSDEEP 3072:RTyxEsx9mnbFiJfjln5xBilmrhuuZzvRH:VyxELFipx5AHu7H
TLSH
T1E5B312AA019F9F37918377C2D7010CF2CD4A64C8A6156ED9D3B70C919EF039A5B8BC59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8514356620:AAHOfYvsppxu9ro7BaS0GIl-VF60KsC5zRU/sendMessage?chat_id=7676646854

Targets

- Target
  c363e567a04e86db78f38568d6aad75186719deac66459276dbba3c458151e70.zip
- Size 112KB
- SHA256 5a0b71ccda76fb56767bef9282ecafbe0385b28d1fa5ab611b80427cf75725fa
- MD5 e9279ef6668ad9d153b335d1505e599c
- SHA1 a70be682d36df32fd395c5365673858cc0bdc44b
- SHA512 a251e0ee92f8fc9cc51001cc810ed7670a3d613d55b45e55e8c6c38bd81d6237f072a916cbaf56ed6c5ab51fa19785b11be11209e0a4826a9f0ee19b1d6907e3
- SSDEEP 3072:RTyxEsx9mnbFiJfjln5xBilmrhuuZzvRH:VyxELFipx5AHu7H
- TLSH
  T1E5B312AA019F9F37918377C2D7010CF2CD4A64C8A6156ED9D3B70C919EF039A5B8BC59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral1 behavioral2
- Target
  c363e567a04e86db78f38568d6aad75186719deac66459276dbba3c458151e70.exe
- Size 151KB
- SHA256 c363e567a04e86db78f38568d6aad75186719deac66459276dbba3c458151e70
- MD5 622ccff40973d7099893300bfcecc434
- SHA1 422ed40f7fdf3aab4f63ed2aec22a9fa8038d7fc
- SHA512 93877fed87b55aec4a249603e34644835c6dfd5e107ed95c8b3dc7ecf5c782dd7bfef7a9722113201f4deaa430c2c01307ebe846c05c062852dba46027a1b3a9
- SSDEEP 1536:rdz8UporgYj1ZIigeH9ml+M/4TBHM9Kl+U4EJ3YWW0zjqY70fVvvtBTnDqhR80Ou:rdz8UporgqIigeQgu03YMfgL7T49BsU
- TLSH
  T153E312027B5CDB3BCF7E07BAA45046DA47B04E7A4C19C6DC9EC1A08FBE17F814911996
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery vipkeylogger keylogger spyware stealer
- Family: VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4