MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da
SHA3-384 hash:	2e16d9982c652d55affcd93e2033aa212ce3051a7d6e76bbb6a67d073da62c4db70f90bf9e9c4e4802222cfe332e2ee6
SHA1 hash:	bfa6c39cdca285754eb02370e2da26645b0d7709
MD5 hash:	d1b18404eb25fb66030bd1e426a639c5
humanhash:	july-carpet-kentucky-fanta
File name:	FİYAT TALEP.pdf.bat
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	909'312 bytes
First seen:	2026-10-09 15:05:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'249 x AgentTesla, 20'551 x Formbook, 12'385 x SnakeKeylogger)
ssdeep	24576:VIKX8Qu5wUEwgvmEkTPYZvBrvbDk8h4Uj2Bx:VIfQufE9vm/YZZvQ8hj
TLSH	T17115AEAA39DEDC2AE0760EB4C4A1F2F203B49D91E621C207CAD57DD77931F81568274B
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	abuse_ch
Tags:	bat exe geo TUR VIPKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

195

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NETReactor RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/bfe1a646-ca16-4485-a2e6-ec36e46f5865/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-09 15:17:15 UTC

Tags:

netreactor ip-check evasion uac stealer smtp snake keylogger

Link:

https://app.any.run/tasks/7633d096-ea12-4425-8d90-d807323ef70d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

VIPKeyLogger

Link:

https://www.capesandbox.com/analysis/91238/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.3664.15906.25203.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Adding an exclusion to Microsoft Defender

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade net_reactor obfuscated packed packed vbnet

Link:

https://www.filescan.io/uploads/6ac902eda23d122fbbade3fc/reports/68154ddf-de69-4765-b6ef-e749f01849fc/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-09T07:47:00Z UTC

Last seen:

2026-10-11T12:48:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/0704bdfe-799c-4315-8004-b2224afbeaa9

Result

Threat name:

VIP Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1984880

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Antivirus detection for URL or domain

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected AntiVM3

Yara detected MSIL Injector

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da

Verdict:

Malware

YARA:

12 match(es)

Tags:

.Net .Net Obfuscator .Net Reactor Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.59 Win 32 Exe x86

Link:

https://app.malva.re/file/d1b18404eb25fb66030bd1e426a639c5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da/

Threat name:

Win32.Backdoor.NjRAT

Status:

Malicious

First seen:

2026-10-09 10:58:04 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ajgvkm6zzu2gigghpadqmqipziuprdrtfepizjvtqiuz37vaipna._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261009-sge38azs3l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Unpacked files

SH256 hash:

024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da

MD5 hash:

d1b18404eb25fb66030bd1e426a639c5

SHA1 hash:

bfa6c39cdca285754eb02370e2da26645b0d7709

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/8f346027-d076-4cf3-8bd3-0a7c70fc44cb/

SH256 hash:

e0ec9f0c0bd998717ad73343ecd370022c0fb59fd8a51f40a8e72a10f5ee1c53

MD5 hash:

4e496b4fdb31de8300f2f11c2554d50e

SHA1 hash:

50dab268d229a994e268e7a4136c69ae9ddb7607

Detections:

triage_snakekeylogger_infostealer

win_404keylogger_g1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/8f346027-d076-4cf3-8bd3-0a7c70fc44cb/

SH256 hash:

405d0dcbe8454646de26e8b2db78435803b99dccdcbcdaa1028c56c7c0c6c3ec

MD5 hash:

3e3fb75f3074003ae2ff07ecfe6fd38d

SHA1 hash:

5200f5572d3167c84842bbff7c48506011585172

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/8f346027-d076-4cf3-8bd3-0a7c70fc44cb/

Parent samples :

64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2
354ed74cf297bdc4d920e3bb357fea7202856277501cbe914b1dfbe8813e841c
7a9bffbf3a920d9b72d73b73cf09f3be5dadf025055f42b5dd12761ab7c8dd34
461ba9a7d6b344421967b3c71630ec4796126b5f20bef32111447ac58e9b9202
a36cbacd3c6950de6319523835e895e8b35e32549c3a4673b3ead5215ad0d3e8
a8a6f5ad5f6bc59b64af1cca3bf0d5b6bcc8686a0dd8a8bb5cb244c2edcf3e23
4e2d3b193a9bfb9f3a369a251a1b722450fa13d8fc193d3c872ebf1062783fde
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
e15e5d4f77fa217cf9ccf18fc0fff19e9b9e47d8c65413f2751904a14fcb8658
024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da
db4732a4b2646f6ddef351784943f58c27311215807a9ba670e9f687366e2a43
b7e0ed86028fb5faa05901945ae751051dc29ac8729b1afc62cc6efe17e20c0a

SH256 hash:

d57e36b0293bb5c4f2a6b06004251645fbdcc11e6f8c0625e29f6fbb02cb97cc

MD5 hash:

b1cc45980e83960314bedf065ca9bf95

SHA1 hash:

6e5e1eab26d2fef1faef56d2667d9e1cca6e7f76

Link:

https://www.unpac.me/results/8f346027-d076-4cf3-8bd3-0a7c70fc44cb/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DotNet_RGB_Embedded_AssemblyLoader_Hunt Create hunting rule
Author:	ShadowOpCode
Description:	Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/91238/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample