Extracted

• • Target
    TSM Enerji ihalesi NTF EMR-01-10-2026 PDF.js
  • Size 1.6MB
  • SHA256 842b79a52924f0d0416c1d2d1819ce1d0f43d2e4f38b82c65f4e787762d7f8b4
  • MD5 6b154dcbcdac7330b0f2779648f1547e
  • SHA1 a7a24992132fe677cdca7584a2f7a7c67ee4df79
  • SHA512 4f709e756a621568754a9bd0dfd5a144788ac272c1fd60654fbcdc5208455cfc6bce782234932864b00e894cc04ec8ff15ac8684b86da67ca22340673588e0e3
  • SSDEEP 24576:iVHv06CuMiB35XCratKglaafgOg91d6pCBbUfG+jrjJGBAs6++/Rp:ePZKROqd63D
  • TLSH
    T1AA75F15089C03FE8EB79561841FD552DE3B10A9B5C2E6A4AF73FBD45AFB750482030AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2