Extracted

• • Target
    TSM Enerji ihalesi NTF EMR-5-30072026 PDF.bat
  • Size 1.2MB
  • SHA256 36c1b04627334fc449ad934a57898e230b52df637baa8d463cdcc536fa564563
  • MD5 be96d1f634baecfb4b41a6cc8acb7878
  • SHA1 facc90870951e81d59b5098d022d4b33eab151f2
  • SHA512 256b96e0150df2ebdfba300322a0c401aa777fce2b47e0d29b9955a7b8e61b118a53e251d0e0587e84fb02434ceb6e673890c00dfd81aed1ee2224a9e43e2d60
  • SSDEEP 24576:4neA9s3kPNiNbQzdt9LqfFW1YiJg/+J4iqZHyXLVAA+f:4eUs3GnZaFW/KGJ4iI8VAb
  • TLSH
    T1A645D0AC3601B49FC457C9358EA4ECB4A6246CBB8307D20395D72DEFBA1D997CE141E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionvipkeyloggerkeyloggerpersistencestealercollectionspyware

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2