Extracted

• • Target
    RESMİ TEKLİF TALEP FORMU PDF.vbs
  • Size 2.7MB
  • SHA256 d536a74a0d4e7beb230e9f36db8c302a3dd7d18dc2b50322680aa497b45cc1fa
  • MD5 ed30d983e85e2335d1c18c27f5a99111
  • SHA1 5c97e1b43c16b526314cd4c0b04afc0074a4de56
  • SHA512 c0428c9548bbd0eaaa382b19525fa5833293d77472a4d6947b0de5cb6b9e9e074fe9f4ca0b80a60af2bd04f3903314002963275f79d54b04feb425ac84f05b61
  • SSDEEP 768:oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO:Hz
  • TLSH
    T115D5B2D442CC6A994479FF64BF9BD8396732BAFA9186AED20B134C12DC10838677C5CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2