MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a
SHA3-384 hash:	e709db27ed5efa882bbff9c6e11be6e147345943613d56cd2df4eb47f37c2183e2213ae727678a14170eb39dbd1ea7b4
SHA1 hash:	a5a1528a2636ce01e221dd94119bc7dc7b9fbb39
MD5 hash:	e40e8e4e8ed6bb4247046b8d88d05b25
humanhash:	nuts-kilo-bulldog-fix
File name:	QUOTATION ORDER.PDF.tbz2
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	361'885 bytes
First seen:	2025-10-28 13:55:52 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:yZwE9QHgoQ+2AZ9PgyyVZWR30oq67XtpwRRrXhwwpxCsv0wAWC44o/tYhQ:Jvb7pdyVFoTzMZXh1pcwAQ4O
TLSH	T182742305728A092CF2029FB728293F1619F39D559E3C3289F8B957E484869DBEFF4417
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	QUOTATION rar tbz2 VIPKeylogger

cocaman

Malicious email (T1566.001)
From: "SARATH CHANDRAN<sales2@speedsafetyuae.com>" (likely spoofed)
Received: "from tekafos.it.com (unknown [72.11.151.184]) "
Date: "28 Oct 2025 06:55:27 -0700"
Subject: "QUOTATION"
Attachment: "QUOTATION ORDER.PDF.tbz2"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	QUOTATION ORDER.PDF.exe
File size:	394'832 bytes
SHA256 hash:	6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113
MD5 hash:	4b355109d84ac4828ae54066cf5ae2f8
MIME type:	application/x-dosexec
Signature	VIPKeylogger

Vendor Threat Intelligence

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6900cb8b9942f1282ec9ac8b

Tags:

injection virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug blackhole guloader installer installer installer-heuristic masquerade microsoft_visual_cc nsis overlay unsafe

Link:

https://www.filescan.io/uploads/6900cb92f1fa8cbc0310358e/reports/8b234b96-c2ef-459f-8f75-1b4200c29eef/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a

Verdict:

Malicious

File Type:

rar

First seen:

2025-10-28T08:37:00Z UTC

Last seen:

2025-10-30T05:37:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Rar Archive

Link:

https://app.malva.re/file/e40e8e4e8ed6bb4247046b8d88d05b25

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a/

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a

Threat name:

Win32.Trojan.Guloader

Status:

Suspicious

First seen:

2025-10-28 13:57:01 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mbiyzloutfg3a7am3gmvba5xevf2jwhxgnv6gybofm2lbhhfhkfa._file

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery keylogger spyware stealer

Link:

https://tria.ge/reports/251028-thqf1sxndr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

VIPKeylogger

Vipkeylogger family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/60518cadd4994db07c0cd9995083b7254ba4d8f7336be3602e2b34b09ce53a8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string