Overview

overview

10

Static

static

5

7f2ba58342...e8.exe

windows10-2004-x64

10

7f2ba58342...e8.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8.exe
  • Size 525KB
  • Sample250905-rckbps1set
  • SHA256 7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
vipkeyloggercollectiondefense_evasiondiscoveryevasionkeyloggerstealertrojanupx

Malware Config

Extracted

Family

  • vipkeylogger

Credentials

Targets

    • Target
      7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8.exe
    • Size 525KB
    • SHA256 7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    collectiondefense_evasiondiscoveryevasionvipkeyloggerkeyloggerstealertrojanupx

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

      stealerkeyloggervipkeylogger

    • Vipkeylogger family

      vipkeylogger

    • Disables Task Manager via registry modification

      defense_evasion

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks