MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bb448c65e845a4b23edf092ed4491301ac97c2116c7ed4c044dbe4bf0338caa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 10

Intelligence 10 IOCs YARA 8 File information Comments

SHA256 hash:	8bb448c65e845a4b23edf092ed4491301ac97c2116c7ed4c044dbe4bf0338caa
SHA3-384 hash:	ce7c263e7e364be7d12a7c70dfabe9c0b842b5a313c39193125a7fd40488e70f0b2497baabd1a00e3725e507a52a6778
SHA1 hash:	861dd72721fbfced3c5c34d2f2d1847e397607f3
MD5 hash:	bb537347916ea107636b3c8c1cd5aa94
humanhash:	lion-one-zebra-happy
File name:	RFQ-SCAN_KT Re-Development.js
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	2'203'362 bytes
First seen:	2026-10-09 15:01:10 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	49152:nlT1e7ZM7nVTNkwLB7IFJq40G/pVCd+4fjm6bA28:2
TLSH	T134A5024BAD06EF5F683B275E8E521EDEA420EB32666818D134CE1DDDD32CE105779388
Magika	javascript
Reporter	abuse_ch
Tags:	js VIPKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

158

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm cscript encrypted fingerprint lolbin obfuscated repaired wscript

Link:

https://www.filescan.io/uploads/6ac901c3ffe44c8815ee4ffa/reports/9face2b0-b405-4e24-991a-599550f11b4c/overview

Verdict:

Malicious

Labled as:

JS.FormBook.1.Generic

Link:

https://www.hybrid-analysis.com/sample/8bb448c65e845a4b23edf092ed4491301ac97c2116c7ed4c044dbe4bf0338caa

Verdict:

Malicious

File Type:

First seen:

2026-10-08T21:45:00Z UTC

Last seen:

2026-10-10T10:16:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/8bb448c65e845a4b23edf092ed4491301ac97c2116c7ed4c044dbe4bf0338caa/results?tab=lookup

Result

Threat name:

VIP Keylogger

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1984891

Signature

.NET source code contains method to dynamically call methods (often used by packers)

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Found malware configuration

Injects a PE file into a foreign processes

JavaScript file contains Antivirus product strings

JavaScript file contains suspicious strings

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8bb448c65e845a4b23edf092ed4491301ac97c2116c7ed4c044dbe4bf0338caa

Verdict:

Malware

YARA:

2 match(es)

Tags:

DeObfuscated Javascript PowerShell T1027 T1059.001 T1059.007

Link:

https://app.malva.re/file/bb537347916ea107636b3c8c1cd5aa94

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8bb448c65e845a4b23edf092ed4491301ac97c2116c7ed4c044dbe4bf0338caa/

Threat name:

Script-JS.Backdoor.FormBook

Status:

Malicious

First seen:

2026-10-09 03:02:25 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 38 (18.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ro2errs6qrnewi7n6cjo2rerganms7bbc3d62taejw7ex4btrsva._file

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection defense_evasion discovery execution keylogger stealer

Link:

https://tria.ge/reports/261009-sd4bmsytav/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Family: VIPKeylogger

Malware Config

C2 Extraction:

https://api.telegram.org/bot8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA/sendMessage?chat_id=6337180137

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery Create hunting rule
Author:	ditekSHen
Description:	Detects JS potentially executing WMI queries

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (script_js, etat binaire)

Rule name:	SUSP_Script_PowerShell_Hidden_Launcher Create hunting rule
Author:	Marjoriefort
Description:	Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:	Veille fraicheur 2026-09-14 / cluster misses web

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample