MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a3ed292ffbe10a366c6c298832cb0ebcb10944f2b30fcbe52097ade905cfde6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 8 File information Comments

SHA256 hash:	6a3ed292ffbe10a366c6c298832cb0ebcb10944f2b30fcbe52097ade905cfde6
SHA3-384 hash:	21dfda3a3ec12c38f83da66d6777cd5219ced2401b95511b32ab2126e3a22ecd0f5658e5bc14f3b4db6d6cddbefd2bf5
SHA1 hash:	fce882c1e83854d57692525df5fa32c7820d22d2
MD5 hash:	cd838215d541f4c0a697b19a1d5084b5
humanhash:	undress-autumn-happy-cola
File name:	PO-INVOICE.tar.001
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	1'100'800 bytes
First seen:	2025-04-14 14:54:53 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-tar
ssdeep	24576:ERxYwke17y0EID2XalWFwXf+5pyewHrAKF6F8Ld339S:SFlA0EIDDsFwv0Mx8CL
TLSH	T1BC352314775A8717E97D57F62253E042063A9378BC30E18DACCE13ED2C0AB917A25E6F
TrID	62.9% (.TAR/GTAR) TAR - Tape ARchive (GNU) (17/3) 37.0% (.TAR) TAR - Tape ARchive (file) (10/3)
Magika	tar
Reporter	cocaman
Tags:	001 INVOICE tar VIPKeylogger

cocaman

Malicious email (T1566.001)
From: ""Abdelmajid" <AlUAHRANI@Schlemmer.com>" (likely spoofed)
Received: "from Schlemmer.com (unknown [45.137.22.99]) "
Date: "14 Apr 2025 07:54:00 -0700"
Subject: "URGENT: NEW PURCHASE ORDER FOR APRIL 2025"
Attachment: "PO-INVOICE.tar.001"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO-INVOICE.exe
File size:	1'099'264 bytes
SHA256 hash:	633fab421c431bf0c98270e6706420cb9945195e17f1a5a2ddcaaf6c56287bde
MD5 hash:	52801720d0495e0bd1f781e22bf48a20
MIME type:	application/x-dosexec
Signature	VIPKeylogger

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Tar_fs1604.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67fd0461d6e7c3effad29fab

Tags:

autorun virus micro msil

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

masquerade obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67fd21cd89fec6b88b9c9d2e/reports/3bfcfc36-b22b-46a1-9cc6-d71370831bcd/overview

Verdict:

Malicious

Labled as:

Malware.U.Generic

Link:

https://www.hybrid-analysis.com/sample/6a3ed292ffbe10a366c6c298832cb0ebcb10944f2b30fcbe52097ade905cfde6

Score:

100%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)