Extracted

Extracted

• • Target
    ISLEM ÖZETI_70868191-1066-1034 19082025 nolu TICAR.pdf.exe
  • Size 792KB
  • SHA256 8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a
  • MD5 a72fbedc6515423321246d11c82db58e
  • SHA1 784867a6c3a76e1947919914e166411208fd1e4d
  • SHA512 acae085913577b13eee8bec210f167a7ba4002cb59911fa8ee2e3937597f6dd300ec53932b29504e9046d9a88b64f49cfe7a86a784ec55213fd1022aa3141931
  • SSDEEP 12288:MXTOwBxSGxz9MVl8d0lGEskv+7MeLYLNB9HcsUEgZn0g2cpL5/XUJm5Kzhan23nw:MxBEGxml8mlX+sL79Hn2Zp269kE4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies trusted root certificate store through registry

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1