MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1648830af70c2b454583dffbd6c7cf47fff51591dfa30b03af269e8719ff89db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VIPKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1648830af70c2b454583dffbd6c7cf47fff51591dfa30b03af269e8719ff89db
SHA3-384 hash: 8ee100b53296b5c08545538449404266228a8c16b35d160bc085cf0d11addb7ef85e44fff30b1f8476e8f64a3532f337
SHA1 hash: 32fa41433b9ebe3597101d100bdb1114a5ec4c49
MD5 hash: 2abc25e3a8e8d80efc4b6a3bc8a53dcd
humanhash: fanta-lithium-wyoming-ceiling
File name:DHL-DOCUMENTS AND INVOICES#.bat
Download: download sample
Signature VIPKeylogger
Create hunting rule
File size:240'598 bytes
First seen:2025-10-02 06:20:03 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 6144:kJ2l+88GFYGGxWptCd8xuwnU62MsEy9Xwy/dZdmOhu3UWyZhU7NRr4va/ZJjBcZF:kJ2P5Vpl/zy/dZdmOhu3UWyZhIr4v+Bu
Threatray 1'650 similar samples on MalwareBazaar
TLSH T190342AF48BF4FFD2235AE5CA46D8EB8B1B4F6702726E569C65AE6CC03B4D5142B10348
Magika batch
Reporter abuse_ch
Tags:bat DHL VIPKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL-DOCUMENTS AND INVOICES#.bat
Verdict:
Malicious activity
Analysis date:
2025-10-02 06:30:38 UTC
Tags:
auto-startup snake keylogger evasion susp-powershell telegram stealer
Link:
https://app.any.run/tasks/b70080ec-fc9f-48af-be23-2f2456fd222a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29889/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68de19e4c21e799f5cd45097
Tags:
obfuscate autorun xtreme shell
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 evasive masquerade obfuscated powershell
Link:
https://www.filescan.io/uploads/68de1abac564c8e81d0c4a80/reports/883bec29-fea5-4334-8ed4-0ea01e1017be/overview
Verdict:
Suspicious
Labled as:
BAT/Agent.AZY
Link:
https://www.hybrid-analysis.com/sample/1648830af70c2b454583dffbd6c7cf47fff51591dfa30b03af269e8719ff89db
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-01T22:36:00Z UTC
Last seen:
2025-10-03T03:39:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/1648830af70c2b454583dffbd6c7cf47fff51591dfa30b03af269e8719ff89db/results?tab=lookup
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1787889
Signature
.NET source code contains a sample name check
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Drops script or batch files to the startup folder
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Sample has a suspicious name (potential lure to open the executable)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1787889 Sample: DHL-DOCUMENTS AND INVOICES#.bat Startdate: 02/10/2025 Architecture: WINDOWS Score: 100 94 reallyfreegeoip.org 2->94 96 api.telegram.org 2->96 98 2 other IPs or domains 2->98 106 Suricata IDS alerts for network traffic 2->106 108 Found malware configuration 2->108 110 Malicious sample detected (through community Yara rule) 2->110 116 13 other signatures 2->116 9 cmd.exe 1 2->9         started        12 cmd.exe 1 2->12         started        14 cmd.exe 1 2->14         started        16 16 other processes 2->16 signatures3 112 Tries to detect the country of the analysis system (by using the IP) 94->112 114 Uses the Telegram API (likely for C&C communication) 96->114 process4 signatures5 120 Suspicious powershell command line found 9->120 18 cmd.exe 1 9->18         started        20 conhost.exe 9->20         started        22 cmd.exe 1 12->22         started        24 conhost.exe 12->24         started        26 cmd.exe 1 14->26         started        28 conhost.exe 14->28         started        30 cmd.exe 16->30         started        32 cmd.exe 1 16->32         started        34 30 other processes 16->34 process6 process7 36 cmd.exe 3 18->36         started        39 cmd.exe 2 22->39         started        41 cmd.exe 2 26->41         started        43 cmd.exe 30->43         started        45 cmd.exe 2 32->45         started        47 cmd.exe 2 34->47         started        49 cmd.exe 34->49         started        51 cmd.exe 34->51         started        53 11 other processes 34->53 signatures8 118 Suspicious powershell command line found 36->118 55 2 other processes 36->55 60 2 other processes 39->60 62 2 other processes 41->62 64 2 other processes 43->64 66 2 other processes 45->66 68 2 other processes 47->68 70 2 other processes 49->70 72 2 other processes 51->72 74 22 other processes 53->74 process9 dnsIp10 100 checkip.dyndns.com 193.122.130.0, 49692, 49694, 49697 ORACLE-BMC-31898US United States 55->100 76 C:\Users\user\AppData\Roaming\...\0941.bat, ASCII 55->76 dropped 122 Drops script or batch files to the startup folder 55->122 124 Found suspicious powershell code related to unpacking or dynamic code loading 55->124 102 api.telegram.org 149.154.167.220, 443, 49699, 49701 TELEGRAMRU United Kingdom 60->102 104 reallyfreegeoip.org 104.21.67.152, 443, 49695, 49698 CLOUDFLARENETUS United States 60->104 78 C:\Users\user\AppData\Roaming\...\6180.bat, ASCII 60->78 dropped 80 C:\Users\user\AppData\Roaming\...\29f9.bat, ASCII 62->80 dropped 126 Loading BitLocker PowerShell Module 62->126 82 C:\Users\user\AppData\Roaming\...\d2e2.bat, ASCII 64->82 dropped 128 Tries to harvest and steal browser information (history, passwords, etc) 64->128 84 C:\Users\user\AppData\Roaming\...\4381.bat, ASCII 66->84 dropped 86 C:\Users\user\AppData\Roaming\...\544a.bat, ASCII 68->86 dropped 88 C:\Users\user\AppData\Roaming\...\3b98.bat, ASCII 70->88 dropped 90 C:\Users\user\AppData\Roaming\...\a04f.bat, ASCII 72->90 dropped 92 11 other malicious files 74->92 dropped 130 Tries to steal Mail credentials (via file / registry access) 74->130 file11 signatures12
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1648830af70c2b454583dffbd6c7cf47fff51591dfa30b03af269e8719ff89db
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1648830af70c2b454583dffbd6c7cf47fff51591dfa30b03af269e8719ff89db/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-02 06:21:57 UTC
File Type:
Text
AV detection:
5 of 38 (13.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=czeigcxxbqvukrmd3755nr6pi777kfmr36rqwa5pe2piogp7rhnq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
104995f5a321eae71389ebd9872e9fc3fdc5132cfe864ca10d0966cf7f27c757
VIPKeylogger
13daad4c1352c39e0372e14c5e87e8b51f3a7ace5a0fe04d220d583b260d1697
VIPKeylogger
4b8fb5faa31496f1f48bdaf1ee7e6f850f631b0b45015ccf31e55cc5b7105c00
VIPKeylogger
5835857507ffd6d949bf2f69e45d965c859ca5791d496e82135ffd9083062bed
VIPKeylogger
864c37e89869ea3662f720df0acabf8cee0c861b5b908515f805746b432a7260
VIPKeylogger
94dde278918e0eab10c0a5818653f73a779d19632fa3f6e603f146bcf709e732
VIPKeylogger
9f298889e338ec83549b41aa0e20713bf17a81afe6dcce141e5085c3a4e2e8af
VIPKeylogger
b355c43bd26f9727f4a9461afe6ee78995deceb671ebfddc6f7cf895cc663a02
VIPKeylogger
bc9850a2d113f4653d3e20d7d09054240d88a74a2157fd213a6433a489d9b81d
VIPKeylogger
dfa331f1fd51ebe6f1d20c667a0bf42c27d634f3d0135aef4ad7c1579d43cdbd
VIPKeylogger
error
VIPKeylogger
+ 1'640 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger stealer
Link:
https://tria.ge/reports/251002-g55s1aaj6z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Looks up external IP address via web service
Drops startup file
Badlisted process makes network request
VIPKeylogger
Vipkeylogger family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1648830af70c2b454583dffbd6c7cf47fff51591dfa30b03af269e8719ff89db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/29889/

Comments