MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 059725803d8b7c6390c8832f0a38bbdc136fa7eb57783f5e8f9461192eac6838. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 10

Intelligence 10 IOCs YARA 14 File information Comments

SHA256 hash:	059725803d8b7c6390c8832f0a38bbdc136fa7eb57783f5e8f9461192eac6838
SHA3-384 hash:	b50ef38750e2f3350d123150ca4b7c8d3d06de259767636e5a42560cd887e1f6e6fb227156c1a43a4cf3443bc1b445bd
SHA1 hash:	21f787f759eaae23dd87ea357e89f2dc4bb14cbf
MD5 hash:	62476eb01a3361e5630be368fd4142ed
humanhash:	north-october-low-pluto
File name:	PURCHASE ORDER LIST 005754.PDF.7z
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	692'341 bytes
First seen:	2025-03-31 12:35:07 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:z5vDgl6U6CKHBb2tLGgtwP90FGSw8tn0cYLzWyLnJ:zZElogggtm8Wch+nJ
TLSH	T13BE433E49B397122ED5E44E108491AC2FDA6CB297DDBF52ADC33A31F411B9C91372389
Magika	zip
Reporter	cocaman
Tags:	7z VIPKeylogger zip

cocaman

Malicious email (T1566.001)
From: "Rajender Singh Adhana <rajender.adhana@reventengineering.com>" (likely spoofed)
Received: "from [195.211.191.34] (unknown [195.211.191.34]) "
Date: "31 Mar 2025 05:33:46 -0700"
Subject: "FW: REQUEST FOR QUOTE OFFICE STATIONARY SUPPLIE CONTRACT TENDER"
Attachment: "PURCHASE ORDER LIST 005754.PDF.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PURCHASE ORDER LIST 005754.PDF.exe
File size:	784'384 bytes
SHA256 hash:	2b1ac729611781564d9b2a76314cc6c2cc5198d54e881191ce7a7439c154f507
MD5 hash:	c1b594b20d261486b5fae2db1cb45177
MIME type:	application/x-dosexec
Signature	VIPKeylogger

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fs3108.UNOFFICIAL

SecuriteInfo.com.Win32.MalwareX-gen.10043.19329.UNOFFICIAL

Sanesecurity.Malware.25510.ZipHeur.Ext.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ea4bebcfd0a37f830ab23c

Tags:

agenttesla snake spam

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/059725803d8b7c6390c8832f0a38bbdc136fa7eb57783f5e8f9461192eac6838/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67ea8c3ef274bf2d8e2a61c0/reports/8c4b7ddb-a7fc-4ffb-96d7-f569a1988670/overview

Verdict:

Malicious

Labled as:

HIDDENEXT/Worm.Generic

Link:

https://www.hybrid-analysis.com/sample/059725803d8b7c6390c8832f0a38bbdc136fa7eb57783f5e8f9461192eac6838

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/059725803d8b7c6390c8832f0a38bbdc136fa7eb57783f5e8f9461192eac6838

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery keylogger spyware stealer

Link:

https://tria.ge/reports/250331-va77jatwd1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

VIPKeylogger

Vipkeylogger family

Malware Config

C2 Extraction:

https://api.telegram.org/bot7277207626:AAGRDtfhvqxeEEY9C2dcl-J2e8y-ub9ECYU/sendMessage?chat_id=7128988401

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/059725803d8b7c6390c8832f0a38bbdc136fa7eb57783f5e8f9461192eac6838

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Suspicious_Latam_MSI_and_ZIP_Files Create hunting rule
Author:	eremit4, P4nd3m1cb0y
Description:	Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)