Extracted

• • Target
    Ticari Hesap Özetiniz.exe
  • Size 771KB
  • SHA256 f9f38e65c2446077739de76e5c37875fb9d000c839fc7ac140826615a5547cfd
  • MD5 6a859c47707f742df414bfd6f2d4b3cb
  • SHA1 ab7817fb96e1877e69d612501d49a9b89036e476
  • SHA512 e92e30992bed51b50893c497cd06e7f9d7c59615686b3c1fea3cdf0fc6215b610194ffb5068b1ae1db628c50bb21ca756a02a16005bb613122135d1e5efcf593
  • SSDEEP 12288:jXeYPpWaZN/cbGFfn8j2zDyIXYjOXMTWkTsp/OyGOs61IYZVAecgs9FMa1Mdq8jp:jOFav/Tv8KmwMTWfp/DGMIYO7MoOL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Outagami.Cal
  • Size 58KB
  • SHA256 c739b07b379277fce4aa4284b6c2048dbb0fc1268df365ad2dfcac17689a1e70
  • MD5 da6fe43ead7c61db328687cbbd02a7a4
  • SHA1 5df9792c3330f176695cbc90b97d0b5c73dda4cc
  • SHA512 1765371676069f6b3f62ea089683999ee727a3c2d0a021e50335ce5928799524d452178ac1ce1f05b7a498c67a5d31d4fce5d46bc4b5fdde82d2e1c66b78118a
  • SSDEEP 1536:HEcy4tMUvO2IzmWfoV8u/Rds7h5firILCgS8U:HEL4tMUvOxzmWfgs7h1VLCg7U
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4