Extracted

Extracted

Extracted

• • Target
    Swift E-Posta Bildirimi_2024-09-23_T11511900.exe
  • Size 714KB
  • SHA256 3da6c537f48990ad2f7bf459249e9ebf35aefd90d32d5b3f41c2528f1d0e4556
  • MD5 413887cf1ae71796db2ff679fd07793a
  • SHA1 6bd4ecd40215521c1e6cef50c0de55e74a7c7ebd
  • SHA512 09d66c79c360b41682ecca209cfa6e278823836d6f3bd415b7e13fc6c18ba7bbd7f0ba955620d1534cb2a402ec843bbdeca8c82adb8e4129acd9e7c53d5493ba
  • SSDEEP 12288:uN+7mnL4M7jDAmAx54q+aW+DakNVgP+lEJqMQwecBwLutNQVlY/tjIHb877a8bQb:uQKvAmAj4qFRDxLg1nhBwQ6G/CbO7pI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2