Extracted

• • Target
    18082026 SİPARİŞ ONAYI_xlsx.js
  • Size 521KB
  • SHA256 c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a
  • MD5 32f1ba909ce5c88145293b4c82ecb6f9
  • SHA1 4260a91fef0bb79ebcf3daa419a191b44b6a21a5
  • SHA512 468615b61f11ac88c15006b49da980646fc9765265629c335faa6ea4d88f64996502dd6bec65feb674bc779436c420f16f651768014fc3ef55921a6977d5bd2e
  • SSDEEP 6144:j6kGPAFxcxtYKdryDL516vmGVbo8l2H/iL9G:euxc7NgGuGb3YH/j
  • TLSH
    T110B4411D1E4E2AC8B065A912D7C6CAF5936EED5BAB9F0D25119BC1DC03A3904DC0BDE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2