Extracted

• • Target
    Fiyat Teklifi Talebimiz..exe
  • Size 721KB
  • SHA256 240813e71ac58f771ec0c63af47acc02ba25d77f32326b121d876ffb751b9e63
  • MD5 32e3fd3b179b52dc87e228fd6bd3f4f4
  • SHA1 cbdde586a8df6697c5008741905fc833c082b498
  • SHA512 599e97173269a42a022522da62e19d12944b2596980f48d4bfab2e4cb3b2b010554c85d884acbf4dbd3d21b7e514b9a4667beb9247207f1a478c8605c0ee4a46
  • SSDEEP 12288:0n+Fv0OW+gtIp3p1JwdcwKooi/U6kI6A8fyaMebCzGUOIdGApGkSzqX5:A+VgOJScwmi/lGyfmCzGUxEbqX5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2