vipkeylogger | 17082026_1528_16082026_doc15088900020260816[.]7z

General

Target
17082026_1528_16082026_doc15088900020260816.7z
Size 47KB
Sample260817-swee8sdn2x
SHA256 8c80bc1204eea53cc18fa8ddf8c933a709e549cc39b18d9263dcbcd5dbbb46c3
MD5 9cd5f584a31fe686d8ecfa6b47728410
SHA1 917da9947434839e7a48a589106959892781b6b7
SHA512 e3fd2580cd2ff34eb65e0eefd5daf855dfc733247ff97c40956d95c5eb6a598a21816c5c26fcbfb67e03ac69570134d52e2ab902486cefb5fd013217d7a1a2bc
SSDEEP 768:yJphEIvxrDfz0VpIzSMd0Ty6Xu7QZPQwLZ143ahN+f32sJNZNvWbxJW+svH9PyO:27prTz6+FCuWEklZ14u+fG6N7I7W+0yO
TLSH
T155230164572F647BFE8C073D45D6A13E6C0931002FD2605863B1E06DA3EA64FB0DAABD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

keylogger stealer vipkeylogger

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.wtktechnologies.com.my
Port
587
Username
[email protected]
Password
ak475898*
Email to
[email protected]

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/doc15088900020260816.exe

File Explorer

17082026_1528_16082026_doc15088900020260816.7z

.7z 47KB
doc15088900020260816.exe

.exe 269KB

17082026_1528_16082026_doc15088900020260816.7z

SHA256 8c80bc1204eea53cc18fa8ddf8c933a709e549cc39b18d9263dcbcd5dbbb46c3
MD5 9cd5f584a31fe686d8ecfa6b47728410
SHA1 917da9947434839e7a48a589106959892781b6b7
SHA512 e3fd2580cd2ff34eb65e0eefd5daf855dfc733247ff97c40956d95c5eb6a598a21816c5c26fcbfb67e03ac69570134d52e2ab902486cefb5fd013217d7a1a2bc
SSDEEP 768:yJphEIvxrDfz0VpIzSMd0Ty6Xu7QZPQwLZ143ahN+f32sJNZNvWbxJW+svH9PyO:27prTz6+FCuWEklZ14u+fG6N7I7W+0yO
TLSH
T155230164572F647BFE8C073D45D6A13E6C0931002FD2605863B1E06DA3EA64FB0DAABD
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

doc15088900020260816.exe

SHA256 d3407128f581ec8e9e002cdff21b68e5d67517b9f8e9371894cafe108750d38b
MD5 c67ea4dfb8a06aa1a1a02d44b8cb6a0a
SHA1 b2b6275d0c4ac9c6af1b01c8c4c2ac4228aed92a
SHA512 93f3c01d6f8685cce8de627b8c71aabfe4b023d8b63c2e537d3ff99eb8e823a0abff04059ecde34885722793985c11e7938a351e53aa4dda39b1404355df8bc2
SSDEEP 3072:GzbpGpbsLPm/j/HSVMEeFVrkU5VyOKIcW90+uw1MQISbcJs0gZYTVgfiypbY:qQ744xuQVb7hb
TLSH
T1A844A58A6FE89801E6FF8437D272C019C6FE7463552D8E2D1691E8162E3DA54CF0AF53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing