MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a
SHA3-384 hash:	0e3924ee3fd92f347f8935871b90ca04d7bf554004543e789d8a60631f34deba776cb366092cced149ec41f30e7f5c6a
SHA1 hash:	4260a91fef0bb79ebcf3daa419a191b44b6a21a5
MD5 hash:	32f1ba909ce5c88145293b4c82ecb6f9
humanhash:	july-london-glucose-alabama
File name:	18082026 SİPARİŞ ONAYI_xlsx.js
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	533'592 bytes
First seen:	2026-08-18 10:37:35 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:j6kGPAFxcxtYKdryDL516vmGVbo8l2H/iL9G:euxc7NgGuGb3YH/j
TLSH	T110B4411D1E4E2AC8B065A912D7C6CAF5936EED5BAB9F0D25119BC1DC03A3904DC0BDE3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	lowmal3
Tags:	js VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

159

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 conhost crypto evasive lolbin masquerade obfuscated overlay persistence powershell repaired wscript

Link:

https://www.filescan.io/uploads/6a843623b4889e9a56d318ea/reports/339ef998-2252-4941-b6d3-71e1e1daf3a6/overview

Hybrid Analysis JS/Agent.EWN

Verdict:

Suspicious

Labled as:

JS/Agent.EWN

Link:

https://www.hybrid-analysis.com/sample/c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a

Joe Sandbox Snake Keylogger, VIP Keylogger

Result

Threat name:

Snake Keylogger, VIP Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1959560

Signature

.NET source code references suspicious native API functions

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Potential evasive JS / VBS script found (domain check)

Sample uses string decryption to hide its real strings

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a/

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-18 09:13:33 UTC

File Type:

Binary

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yadubvrhukrbxsk3r5keewlajzzf6lxlrkxhl3ml4hkwtnbczofa._file

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery execution keylogger persistence stealer

Link:

https://tria.ge/reports/260818-mpmkdagf68/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: VIPKeylogger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a