MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 12

Intelligence 12 IOCs YARA 3 File information Comments

SHA256 hash:	2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c
SHA3-384 hash:	3f55c20d4b70323300f285b7eda50be7980c46e247c554a2e7657a2cdfc4c8dc5406bed9a24ba53624626545613b2129
SHA1 hash:	a4e168207c8c23c6606379b244286f224328158c
MD5 hash:	300bcf201ea3d101d0e83eac91ae3fa7
humanhash:	avocado-kansas-sodium-harry
File name:	mystery.ps1
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	122'216 bytes
First seen:	2026-04-23 23:06:36 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3072:QQjzsEnnARv0eCvW7D1BX6hH1ShFlRqJGV:QQnswS97DzXaVQlR/
Threatray	4'040 similar samples on MalwareBazaar
TLSH	T1C9C312CA5E414EED732BA29C35D7395ED1ADBA08D0D68A1034C07BE7DC6C94610EBE07
Magika	powershell
Reporter	BastianHein
Tags:	ps1 VIPKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Script.SNH-gen.75354554.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69eaa63d4aed15d0792fba8a

Tags:

backdoor emotet shell sage

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

aes base64 crypto encrypted obfuscated powershell

Link:

https://www.filescan.io/uploads/69eaa6324cc9288c910a5e10/reports/cf6041ea-4aff-4342-a95f-5491f1ba1f55/overview

Verdict:

Malicious

Labled as:

CMD:BZC.PZQ.Boxter.441

Link:

https://www.hybrid-analysis.com/sample/2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-15T05:13:00Z UTC

Last seen:

2026-04-23T20:28:00Z UTC

Hits:

~10

Detections:

PDM:Trojan.Win32.Generic Exploit.Win64.Shellcode.sliverloader.a

Link:

https://opentip.kaspersky.com/2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c/results?tab=lookup

Score:

63%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c/

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-04-23 23:07:36 UTC

File Type:

Text (PowerShell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fr6uitdpcw7zh7qomr3nrgzz64cl7teerj3spzgbaaspws7474ga._file

Verdict:

malicious

Label(s):

donutloader

vipkeylogger

VIPKeylogger

40d804b9813d3a6d40b7f33db2c2a09eeeff1b06413f2dfb06442176b4589b9f

VIPKeylogger

43c3b30872f76dbff6759c2d335276629a665f91953db1b02c2dc5d972a1d242

VIPKeylogger

5228cdea84a04c9047fd321efcde0b729a7b2fb036328f8c68c4379ea50c9f9a

VIPKeylogger

6a86b3beed4068b73085adefe5be7d97acf1bbb349442243f6ab304641193bb3

VIPKeylogger

6a94e0e6917dac14fe32db0e46e328251ca2baa5551712ab5a9b6e008a0ebd6c

VIPKeylogger

758527c909ad5194d44d97c8609ad8916d6d78c62c182531cddd939ce29d9074

VIPKeylogger

b999354f59d775130e8f62e9fadf47da75dd0b5d8c2957cedf89a2bb23d79026

VIPKeylogger

c701c60f95ac81fa170a53fe5630bb07a53e03040336294927e564457d3754a8

VIPKeylogger

e178ec2c637f8340288d0928c5de1a852e5f6fdded6327cfb3fc2c752f0c88cd

VIPKeylogger

error

VIPKeylogger

+ 4'030 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:donutloader family:vipkeylogger collection discovery execution keylogger loader stealer

Link:

https://tria.ge/reports/260423-2376kahx6l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Detects DonutLoader

Family: DonutLoader

Family: VIPKeylogger

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample