MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VIPKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757
SHA3-384 hash: 368bab2d873b7eed51d091482c282aa9fb6b16ab1234cc7f3113789d74923687e3df205a46d00bb3e6e94bc9fdc2c2e2
SHA1 hash: b91da7a2fa109f3eb56945236345426917f5b061
MD5 hash: bc980759f7c20d7df2f5ee5529a46cfa
humanhash: queen-high-montana-ink
File name:DHL Express shipment receipt for waybill =643567646322#.bat
Download: download sample
Signature VIPKeylogger
Create hunting rule
File size:240'509 bytes
First seen:2025-10-01 15:14:01 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 6144:Tj5+88GFYGGxWptCd8xuwnU62MsEy9QIpWSygZTn9pgh28:TH5Vpl/bIpWShl828
Threatray 2'188 similar samples on MalwareBazaar
TLSH T1F7343BF44BF4FFE6235DB6DA86DAEA8F0B0F2711B26E465866AD6CC0374D5106B20344
Magika batch
Reporter abuse_ch
Tags:bat DHL VIPKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL Express shipment receipt for waybill =643567646322#.bat
Verdict:
Malicious activity
Analysis date:
2025-10-01 15:24:53 UTC
Tags:
auto-startup evasion susp-powershell snake keylogger telegram stealer
Link:
https://app.any.run/tasks/6ce84f8f-1af1-440d-8239-c6f195f11026

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29791/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68dd45d07d643f33eab920f2
Tags:
obfuscate autorun xtreme shell
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 evasive masquerade obfuscated powershell stealer
Link:
https://www.filescan.io/uploads/68dd46d06c140e5b35002b4e/reports/b02d8ee2-47f2-4f9f-8ba9-e3c7ff320ff6/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-30T22:05:00Z UTC
Last seen:
2025-10-03T11:51:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757/results?tab=lookup
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1787441
Signature
.NET source code contains a sample name check
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Drops script or batch files to the startup folder
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1787441 Sample: DHL Express shipment receip... Startdate: 01/10/2025 Architecture: WINDOWS Score: 100 94 reallyfreegeoip.org 2->94 96 api.telegram.org 2->96 98 2 other IPs or domains 2->98 108 Suricata IDS alerts for network traffic 2->108 110 Found malware configuration 2->110 112 Malicious sample detected (through community Yara rule) 2->112 118 12 other signatures 2->118 9 cmd.exe 1 2->9         started        12 cmd.exe 2->12         started        14 cmd.exe 1 2->14         started        16 16 other processes 2->16 signatures3 114 Tries to detect the country of the analysis system (by using the IP) 94->114 116 Uses the Telegram API (likely for C&C communication) 96->116 process4 signatures5 122 Suspicious powershell command line found 9->122 18 cmd.exe 1 9->18         started        20 conhost.exe 9->20         started        22 cmd.exe 12->22         started        24 conhost.exe 12->24         started        32 2 other processes 14->32 26 cmd.exe 1 16->26         started        28 cmd.exe 1 16->28         started        30 cmd.exe 1 16->30         started        34 29 other processes 16->34 process6 process7 36 cmd.exe 3 18->36         started        39 cmd.exe 22->39         started        41 cmd.exe 2 26->41         started        43 cmd.exe 2 28->43         started        45 cmd.exe 2 30->45         started        47 cmd.exe 32->47         started        49 cmd.exe 34->49         started        51 cmd.exe 34->51         started        53 11 other processes 34->53 signatures8 120 Suspicious powershell command line found 36->120 55 2 other processes 36->55 60 2 other processes 39->60 62 2 other processes 41->62 64 2 other processes 43->64 66 2 other processes 45->66 68 2 other processes 47->68 70 2 other processes 49->70 72 2 other processes 51->72 74 22 other processes 53->74 process9 dnsIp10 100 checkip.dyndns.com 132.226.247.73, 49686, 49692, 49695 UTMEMUS United States 55->100 102 api.telegram.org 149.154.167.220, 443, 49688, 49694 TELEGRAMRU United Kingdom 55->102 104 reallyfreegeoip.org 172.67.177.134, 443, 49687, 49693 CLOUDFLARENETUS United States 55->104 76 C:\Users\user\AppData\Roaming\...\660d.bat, ASCII 55->76 dropped 124 Drops script or batch files to the startup folder 55->124 126 Found suspicious powershell code related to unpacking or dynamic code loading 55->126 128 Loading BitLocker PowerShell Module 55->128 106 132.226.8.169, 49746, 49749, 49751 UTMEMUS United States 60->106 78 C:\Users\user\AppData\Roaming\...\e327.bat, ASCII 60->78 dropped 130 Tries to harvest and steal browser information (history, passwords, etc) 60->130 80 C:\Users\user\AppData\Roaming\...\0246.bat, ASCII 62->80 dropped 82 C:\Users\user\AppData\Roaming\...\963f.bat, ASCII 64->82 dropped 84 C:\Users\user\AppData\Roaming\...\f2e5.bat, ASCII 66->84 dropped 86 C:\Users\user\AppData\Roaming\...\f475.bat, ASCII 68->86 dropped 88 C:\Users\user\AppData\Roaming\...\b7d2.bat, ASCII 70->88 dropped 90 C:\Users\user\AppData\Roaming\...\185c.bat, ASCII 72->90 dropped 92 11 other malicious files 74->92 dropped 132 Tries to steal Mail credentials (via file / registry access) 74->132 file11 signatures12
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-01 15:16:40 UTC
File Type:
Text (Batch)
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cbezl5ndehvooe4j5pmyolu7yp64kezm72deziinbftm67zhy5lq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
09b8a80183a41a92c60fbacf9ee319291e37ae6d4ce0521b23b236b46e095956
VIPKeylogger
13daad4c1352c39e0372e14c5e87e8b51f3a7ace5a0fe04d220d583b260d1697
VIPKeylogger
4b8fb5faa31496f1f48bdaf1ee7e6f850f631b0b45015ccf31e55cc5b7105c00
VIPKeylogger
5835857507ffd6d949bf2f69e45d965c859ca5791d496e82135ffd9083062bed
VIPKeylogger
8ece82ad36ddad1e13a955098ea9629364950ed21a1155d7be4921208e62eb0c
VIPKeylogger
b355c43bd26f9727f4a9461afe6ee78995deceb671ebfddc6f7cf895cc663a02
VIPKeylogger
bc9850a2d113f4653d3e20d7d09054240d88a74a2157fd213a6433a489d9b81d
VIPKeylogger
dfa331f1fd51ebe6f1d20c667a0bf42c27d634f3d0135aef4ad7c1579d43cdbd
VIPKeylogger
error
VIPKeylogger
+ 2'178 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger stealer
Link:
https://tria.ge/reports/251001-sraw9axxgx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Looks up external IP address via web service
Drops startup file
Badlisted process makes network request
VIPKeylogger
Vipkeylogger family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/29791/

Comments