MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319
SHA3-384 hash:	89fb813d582dade1fe17bd265c2400b8a530e2a1279a80d01007f09bfc4e89095bac7788e86b298a9b0a80451b95c7e5
SHA1 hash:	32f8ee14cad89df46bde23e125ef9a544bd62a46
MD5 hash:	4c1ada8899dcbcde78cdbe3f0738d367
humanhash:	purple-zebra-venus-alabama
File name:	ÇİZİMLER, RESİMLER VE KAPSAMLI ÜRÜN AÇIKLAMASI_img.hta
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	1'628'308 bytes
First seen:	2026-07-29 14:45:15 UTC
Last seen:	Never
File type:	hta
MIME type:	text/plain
ssdeep	192:EpCKHNX4TYRI8IbKI8+gI0Dps2lTOfEj5:EkKHHRI8IbKI8+gI0DnlTOfs
TLSH	T1C3755C5EB789235A35A9C694AA5BCB7B2CC4C0121EF19F0F704D699D70EF74AA580C33
Magika	javascript
Reporter	lowmal3
Tags:	hta VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

31

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319/results/dashboard

Payload URLs

URL

File name

https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/OElUG

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a6a2abb524b0715422a0236/reports/48badd3d-b240-45ad-bfde-cc6662bcb923/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-07-29T04:22:00Z UTC

Last seen:

2026-07-31T12:37:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319/results?tab=lookup

Joe Sandbox Snake Keylogger, VIP Keylogger

Result

Threat name:

Snake Keylogger, VIP Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1949669

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Powershell decode and execute

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/4c1ada8899dcbcde78cdbe3f0738d367

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319/

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-29 13:19:38 UTC

File Type:

Binary

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=evez3m63wszcwtk4ejia2jmhgjryzmm43fxstnxnuimmhre32mmq._file

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery execution keylogger stealer

Link:

https://tria.ge/reports/260729-tz9afsbn2w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Badlisted process makes network request

Family: VIPKeylogger

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319