Extracted

Extracted

• • Target

    Bursaderiosb_Sorgu_04.11.24.doc.exe

  • Size

    791KB

  • MD5

    bf641cbd10ecb47360eb5f51aa1e18dd

  • SHA1

    8cf79b4e1c56efa27686e75be6763d1626c52418

  • SHA256

    cdcc9af94476ea2f08b7a948e5293405cf65e87a2496f3fd7743a35128bca523

  • SHA512

    00b679d1afbb028951af5e0258d44ee9c59a38c6824078eb22cd606e146c4b6b60fdc8394cb1415beea6a9b78d8564ec0ae24429513452c907ec2f834d12b880

  • SSDEEP

    24576:FY5/fh8ztYct9XR8UdtCVK9V7U3dMuZBBzjwYMXj3:K2tJ8UTCE7YJwHj

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2