MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VIPKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777
SHA3-384 hash: b985f8f47328d700f28c17e7b1aefcf19a0ee3deb2387063b7e9682ace4fbac31ea4b22560ffe2738599b920f8c09fad
SHA1 hash: 1f58b684aca32ffc6aa0d2684772bbd72c9aa69c
MD5 hash: c0fb01b572eb0d863f470df8c93cbb5f
humanhash: william-football-oregon-one
File name:rtransferencia_345335.exe
Download: download sample
Signature VIPKeylogger
Create hunting rule
File size:760'448 bytes
First seen:2025-02-13 20:00:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b40f29cd171eb54c01b1dd2683c9c26b (45 x GuLoader, 16 x RemcosRAT, 15 x VIPKeylogger)
ssdeep 12288:LF9pu9R98DvOx0dy38SeD83S1kAqjxnE8UML789zUO9vVOI0emBmZ:TpCUqxx3lRsJqjxnlGUOdb0emBmZ
Threatray 187 similar samples on MalwareBazaar
TLSH T17FF4230649E4DC52DEBC4B72287B0E66D972C89D09087B1F17A09527AB0677BFDE90C3
TrID 92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133)
3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
1.1% (.EXE) Win64 Executable (generic) (10522/11/4)
0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon 950c9c9888a8a4a4 (11 x VIPKeylogger, 1 x GuLoader)
Reporter FXOLabs
Tags:exe signed VIPKeylogger

Code Signing Certificate

Organisation:Herald
Issuer:Herald
Algorithm:sha256WithRSAEncryption
Valid from:2024-11-08T05:22:07Z
Valid to:2025-11-08T05:22:07Z
Serial number: 189ca9e8d5ac6311fb75f2fc390f53a28a66087d
Thumbprint Algorithm:SHA256
Thumbprint: 9b15a7147e7e9c2995e661f5da8b850efad478841bc5838dc6d5baae035e1158
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
487
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rtransferencia_345335.exe
Verdict:
Malicious activity
Analysis date:
2025-02-13 20:02:52 UTC
Tags:
evasion snake keylogger telegram stealer
Link:
https://app.any.run/tasks/8a0f14e4-fe4c-4806-bb22-b94f52fc779a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Malware.Dropper.Heur.11643.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ae4f5b28ab76d43a5adbfb
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Delayed reading of the file
Creating a file
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context blackhole installer microsoft_visual_cc obfuscated overlay signed
Link:
https://www.filescan.io/uploads/67ae4f5b991985e0a9587174/reports/ec0ebe4e-ba0c-489c-98b9-038dfbf9a1fd/overview
Verdict:
Malicious
Labled as:
Injector.HLKB
Link:
https://www.hybrid-analysis.com/sample/2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5490a71d-c71c-483d-bc44-337d496db8f3
Result
Threat name:
GuLoader, Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1614551
Signature
AI detected suspicious PE digital signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect the country of the analysis system (by using the IP)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected GuLoader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f23zu67yogrkm6ocnueyiwmw37xphlzra3mhbctsis6kgaan653q._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2
VIPKeylogger
2f61e87b9efc40e20b2ea6dbd7f304a0cdaacea53c7407bb6da45d2e6302a905
VIPKeylogger
6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5
VIPKeylogger
889a4438087185a1fde0f03e7cd63429784cb000b31ec1121155528eb8213892
VIPKeylogger
acf25f959cbb9c5ce26c16792b997f3bdd28927bd23614e466a4bbf2a0322029
VIPKeylogger
bdad372e1916a731f45edde8e2db92eadfb2eda17441fb58963e87002bd4dbbd
VIPKeylogger
c1a82c6f221c8285b77caf7af892cb54cb62970ad9952d8bd715ec12fb4e2d8e
VIPKeylogger
error
VIPKeylogger
f1b6f735c651a28ecb97d4b9e21adc5d79ebed5b2686482f58ae33df3f13492d
VIPKeylogger
fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c
VIPKeylogger
+ 177 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:vipkeylogger collection discovery downloader keylogger spyware stealer
Link:
https://tria.ge/reports/250213-yq35astqfw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Guloader family
Guloader,Cloudeye
VIPKeylogger
Vipkeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7860252135:AAFnqHLJ-Ng3O61cPpFaVL17gS5Ru2j08qg/sendMessage?chat_id=744079942
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d0269d76-3f38-444c-846c-8e4785011415
Unpacked files
SH256 hash:
2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777
MD5 hash:
c0fb01b572eb0d863f470df8c93cbb5f
SHA1 hash:
1f58b684aca32ffc6aa0d2684772bbd72c9aa69c
Link:
https://www.unpac.me/results/add3e3f6-1128-43cb-8350-102189d01024/
SH256 hash:
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 hash:
cf85183b87314359488b850f9e97a698
SHA1 hash:
6b6c790037eec7ebea4d05590359cb4473f19aea
Link:
https://www.unpac.me/results/add3e3f6-1128-43cb-8350-102189d01024/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

VIPKeylogger

Executable exe 2eb79a7bf871a2a679c26d09845996dfeef3af3106d8708a7244bca3000df777

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteA
SHELL32.dll::SHFileOperationA
SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDiskFreeSpaceA
KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileA
KERNEL32.dll::GetWindowsDirectoryA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExA
USER32.dll::OpenClipboard
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments