MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113
SHA3-384 hash:	9ce8b97e7bbe99aa4ebc37caa06fa14c7201e7c87cc3fc68590edb976352e765dbdcd8f5ac18dc17bbc86276c2f3cf54
SHA1 hash:	073deb1f85186bfebd10f0ceb45bb1157df7caf0
MD5 hash:	4b355109d84ac4828ae54066cf5ae2f8
humanhash:	connecticut-diet-low-lemon
File name:	QUOTATION ORDER.PDF.exe
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	394'832 bytes
First seen:	2025-10-28 13:55:55 UTC
Last seen:	2025-11-06 11:35:14 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1f23f452093b5c1ff091a2f9fb4fa3e9 (303 x GuLoader, 47 x AgentTesla, 47 x RemcosRAT)
ssdeep	12288:59USOe0uGsTxb2VJedjrrnUd5scy59v9Nv:59Ukjxb2VQdjrrCL49vv
TLSH	T1498412463AE0C567DAC846B19F7694FAEBBBCE150804430B2B547F477C366B2690B363
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	d022d8c8f28f80c0 (44 x GuLoader, 12 x VIPKeylogger, 7 x Formbook)
Reporter	cocaman
Tags:	exe QUOTATION VIPKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113.exe

Verdict:

Malicious activity

Analysis date:

2025-10-28 13:57:55 UTC

Tags:

snake keylogger evasion telegram stealer

Link:

https://app.any.run/tasks/94651724-7f8b-4711-a4fc-839062bc4913

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34515/

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6900cb8b9942f1282ec9ac8b

Tags:

injection virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Searching for the window

Creating a file

Delayed reading of the file

Restart of the analyzed sample

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

installer masquerade microsoft_visual_cc obfuscated overlay packed packer_detected

Link:

https://www.filescan.io/uploads/6900cb93b33c704cbf9319f0/reports/dd2fc724-1435-4710-bbd7-a5093bede0ac/overview

Verdict:

Malicious

Labled as:

Malware_52.9

Link:

https://www.hybrid-analysis.com/sample/6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-28T08:34:00Z UTC

Last seen:

2025-10-30T08:11:00Z UTC

Hits:

~1000

Detections:

Trojan.Win32.GuLoader.sb Trojan.NSIS.Pakes.Krynis.sb HEUR:Trojan.Win32.GuLoader.gen Trojan-Downloader.Win32.Minix.sb Trojan.NSIS.Makoob.sba Packed.NSIS.Krynis.sb

Link:

https://opentip.kaspersky.com/6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113/results?tab=lookup

Malware family:

Unlabeled

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/090eae15-0e51-4bb0-9f1a-9aba661fedb9

Result

Threat name:

GuLoader, Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1803247

Signature

Antivirus / Scanner detection for submitted sample

Found malware configuration

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses the Telegram API (likely for C&C communication)

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/4b355109d84ac4828ae54066cf5ae2f8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113/

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113

Threat name:

Win32.Trojan.Guloader

Status:

Suspicious

First seen:

2025-10-28 11:33:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mjlmejli4ysflnxpj7ahmbvdgyf5v2apl5h5vaqtdtr5h6jdqejq._file

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery keylogger spyware stealer

Link:

https://tria.ge/reports/251028-q82eeshl6t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

VIPKeylogger

Vipkeylogger family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0f553ccf-0c07-4b3f-89fa-0571c69212ad

Unpacked files

SH256 hash:

6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113

MD5 hash:

4b355109d84ac4828ae54066cf5ae2f8

SHA1 hash:

073deb1f85186bfebd10f0ceb45bb1157df7caf0

Link:

https://www.unpac.me/results/9728e870-f648-44a1-b430-2760c54e4631/

SH256 hash:

a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

MD5 hash:

75ed96254fbf894e42058062b4b4f0d1

SHA1 hash:

996503f1383b49021eb3427bc28d13b5bbd11977

Link:

https://www.unpac.me/results/9728e870-f648-44a1-b430-2760c54e4631/

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6256c22568e6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

DriveBy Activity

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/6256c22568e62455b6ef4fc07606a3360bdae80f5f4fda82131ce3d3f9238113

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string