🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VIPKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4
SHA3-384 hash: bc7b6c940c5c79ecdf27a770dd7f22b709cc56d96fca12be24d1018111587430497fb592d0d3ac26f760ecada43d819d
SHA1 hash: df56229a214e9a083d9fe6fde8565f1e1c96b5d4
MD5 hash: f799944a789f651c4c80f5c7fe3d66f0
humanhash: johnny-green-louisiana-quebec
File name:ENQ PO_S23BK-ABPROCESS.bat
Download: download sample
Signature VIPKeylogger
Create hunting rule
File size:556'490 bytes
First seen:2026-03-23 12:49:52 UTC
Last seen:2026-03-24 07:26:40 UTC
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 12288:Fnpnq1bxZAvdrDJ4nEjK7Qggcg9lqtfw/gvSgOX:FIOJmnEKgCfUg6gC
TLSH T125C4022189C87F75DFB85A1850FE161E63F1868E4567698AFF23BE0AEFE750442070C9
Magika batch
Reporter lowmal3
Tags:bat VIPKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
5d4eb74bfdcc185ce0150dd7ffdc85c6cc6f43285cd8c878da22f1d561c22ba0.zip
Verdict:
Malicious activity
Analysis date:
2026-03-23 12:50:09 UTC
Tags:
arch-exec susp-powershell evasion snake keylogger donutloader loader
Link:
https://app.any.run/tasks/444ee867-efcf-4785-825a-81d531f0ecc1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58855/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c13700390b99647412fcad
Tags:
autorun rapid
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching cmd.exe command interpreter
Creating a file in the %AppData% subdirectories
Running batch commands
Launching a process
Creating a file
Creating a process from a recently created file
Sending a custom TCP request
Enabling autorun
Verdict:
Suspicious
Labled as:
BAT/Agent.BMF
Link:
https://www.hybrid-analysis.com/sample/8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4
Verdict:
Malicious
File Type:
unix shell
Detections:
Trojan.Win32.Shellcode.sb Trojan.PowerShell.Cobalt.sb HEUR:Trojan.MSIL.Rozena.gen Backdoor.Win32.Androm.sb Backdoor.MSIL.Cardinal.sb Exploit.Win64.Shellcode.sliverloader.a PDM:Trojan.Win32.Generic HEUR:Trojan.BAT.Cobalt.gen Trojan-PSW.Win32.Stealer.sb HEUR:Backdoor.MSIL.Agent.gen Trojan-PSW.Win32.Stelega.sb Trojan-Dropper.Win32.Injector.sb
Link:
https://opentip.kaspersky.com/8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4/results?tab=lookup
Result
Threat name:
DonutLoader, Snake Keylogger, VIP Keylog
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1887598
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Compiles code for process injection (via .Net compiler)
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Encrypted powershell cmdline option found
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected DonutLoader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1887598 Sample: ENQ PO_S23BK-ABPROCESS.bat Startdate: 23/03/2026 Architecture: WINDOWS Score: 100 47 reallyfreegeoip.org 2->47 49 api.telegram.org 2->49 51 3 other IPs or domains 2->51 59 Suricata IDS alerts for network traffic 2->59 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 69 15 other signatures 2->69 10 cmd.exe 1 2->10         started        signatures3 65 Tries to detect the country of the analysis system (by using the IP) 47->65 67 Uses the Telegram API (likely for C&C communication) 49->67 process4 signatures5 85 Suspicious powershell command line found 10->85 87 Uses cmd line tools excessively to alter registry or file data 10->87 89 Encrypted powershell cmdline option found 10->89 91 Bypasses PowerShell execution policy 10->91 13 cmd.exe 3 10->13         started        16 conhost.exe 10->16         started        process6 signatures7 93 Suspicious powershell command line found 13->93 95 Uses cmd line tools excessively to alter registry or file data 13->95 97 Encrypted powershell cmdline option found 13->97 18 powershell.exe 23 13->18         started        22 powershell.exe 16 13->22         started        24 cmd.exe 1 13->24         started        26 3 other processes 13->26 process8 file9 41 C:\Users\user\AppData\...\wmuuihph.cmdline, Unicode 18->41 dropped 43 C:\Users\user\AppData\Local\...\wmuuihph.0.cs, Unicode 18->43 dropped 71 Injects code into the Windows Explorer (explorer.exe) 18->71 73 Writes to foreign memory regions 18->73 75 Creates a thread in another existing process (thread injection) 18->75 28 explorer.exe 48 10 18->28 injected 32 csc.exe 3 18->32         started        45 C:\Users\user\AppData\...\4dx9BrVWCDFG.ps1, Unicode 22->45 dropped 77 Found suspicious powershell code related to unpacking or dynamic code loading 22->77 79 Compiles code for process injection (via .Net compiler) 22->79 81 Uses cmd line tools excessively to alter registry or file data 24->81 35 reg.exe 1 24->35         started        83 Creates an undocumented autostart registry key 26->83 signatures10 process11 dnsIp12 53 checkip.dyndns.com 132.226.247.73, 49722, 49726, 49728 UTMEMUS United States 28->53 55 api.telegram.org 149.154.166.110, 443, 49739 TELEGRAMRU United Kingdom 28->55 57 2 other IPs or domains 28->57 99 System process connects to network (likely due to code injection or exploit) 28->99 101 Tries to steal Mail credentials (via file / registry access) 28->101 103 Tries to harvest and steal browser information (history, passwords, etc) 28->103 105 Unusual module load detection (module proxying) 28->105 39 C:\Users\user\AppData\Local\...\wmuuihph.dll, PE32 32->39 dropped 37 cvtres.exe 1 32->37         started        file13 signatures14 process15
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4
Threat name:
Win32.Trojan.Acll
Create hunting rule
Status:
Malicious
First seen:
2026-03-23 04:42:57 UTC
File Type:
Text (Batch)
AV detection:
13 of 37 (35.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjwqxge2vjwueqw67rmo5n6s4wqt3cem5x23wrrjjlk3pxsmsk2a._file
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:vipkeylogger adware collection defense_evasion discovery execution keylogger loader persistence spyware stealer
Link:
https://tria.ge/reports/260323-p2341ah19v/
Behaviour
Delays execution with timeout.exe
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Looks up external IP address via web service
Detects DonutLoader
DonutLoader
Donutloader family
Modifies WinLogon for persistence
VIPKeylogger
Vipkeylogger family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

VIPKeylogger

Batch (bat) bat 8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/58855/

Comments