Extracted

• • Target
    ZİRAAT BANKASI ÖDEME TAVSİYESİ_html.exe
  • Size 1021KB
  • SHA256 348379e04d8c9defb167f9b86bdabbab2ac4f95ea7ee6b1ea2bed36eafc62c95
  • MD5 bde758c45139882f9e9aa02909a83e0f
  • SHA1 64ffc37998d6135827c3aeb2069618f12f65efa5
  • SHA512 f8f8a7c1719946316992477b69c7eb0014dfb49417f89905454cc97d45d2c47f3a6a887461b75f29a49dbbae2c63a4e972a274a0a413086a677dbd9f3b5ba809
  • SSDEEP 12288:rtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaT156lH2fZAn00fp56A:rtb20pkaCqT5TBWgNQ7aTT3yh56A
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2