MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 13

Intelligence 13 IOCs YARA 6 File information Comments

SHA256 hash:	8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06
SHA3-384 hash:	14f294f6613f67694d79b5bedcb149d82a38371d024a0d9f7e75566353d02ed6d85111bc7b0f3448e8c8a5f79e91b8e6
SHA1 hash:	7f7031c45842d65206bdc2f11f4b591d9a58bc88
MD5 hash:	5ce25cf23a6b0d82d42bd25b525ab59f
humanhash:	kentucky-massachusetts-sierra-triple
File name:	Justificante_Pago_Certificado_Corriente_Pago-67788909-767676767676.exe
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	296'856 bytes
First seen:	2026-10-14 15:11:42 UTC
Last seen:	2026-10-19 07:39:18 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	46ce5c12b293febbeb513b196aa7f843 (48 x GuLoader, 21 x RemcosRAT, 15 x AgentTesla)
ssdeep	6144:jX45rw6BsvoivXiV0LIM81O1gpXtYslySPEgZKQ:jX4pgvXiaLS0MtzTZd
TLSH	T1F154121557B0E4BBD8360970AC7986FA2FE96A1559D81B431300BB4E7E33BA04E5F31E
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	16064646468e9632 (2 x VIPKeylogger, 1 x GuLoader)
Reporter	TomU
Tags:	exe signed VIPKeylogger

Code Signing Certificate

Organisation:	Stablemaskines
Issuer:	Stablemaskines
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-08-03T05:55:26Z
Valid to:	2027-08-03T05:55:26Z
Serial number:	3feb5ae7a5f4376c08534f454d546d627c0e1b2c
Thumbprint Algorithm:	SHA256
Thumbprint:	bc5514d2bf06c3a5225d57f224f21ecba741e319fc343ae35247ca1e64cbf34b
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NSIS

Details

Link:

https://research.acce.ciphertechsolutions.com/results/48e40784-cb23-428c-b3de-014c7decf56b/

Malware family:

n/a

ID:

File name:

QuarantineMessage(1).zip

Verdict:

Malicious activity

Analysis date:

2026-09-01 07:59:32 UTC

Tags:

qrcode attc-arch attachments arch-exec

Link:

https://app.any.run/tasks/c99a4fa1-791e-4b96-be88-a4b16d30b2cd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91818/

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.68336532.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad145016f551121ba16570e

Tags:

injection obfusc virus

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Searching for the window

Creating a file

Sending a custom TCP request

Launching a service

Creating a file in the %AppData% subdirectories

Delayed reading of the file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug base64 installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance signed

Link:

https://www.filescan.io/uploads/6acf9be43467caad9948b113/reports/fb80aa26-b167-4169-9f86-24a82debe3b3/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-01T00:41:00Z UTC

Last seen:

2026-10-16T13:01:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8d755e6f-ae16-4ea2-9563-88d8b552cf64

Score:

85%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/5ce25cf23a6b0d82d42bd25b525ab59f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06/

Threat name:

Win32.Trojan.Makoob

Status:

Suspicious

First seen:

2026-09-01 04:21:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 34 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r5txd7lkkzjhvg5khjdmyytmbetuws3enm6f5dydrqps7ipubuda._file

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:guloader family:vipkeylogger collection defense_evasion discovery downloader keylogger privilege_escalation spyware stealer

Link:

https://tria.ge/reports/261014-slchwsex91/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: Guloader,Cloudeye

Family: VIPKeylogger

Malware Config

C2 Extraction:

https://api.telegram.org/bot7952650367:AAHKe89MlSGPcIgTlc0s96jw4hvrUkB-lEU/sendMessage?chat_id=8579883216

Unpacked files

SH256 hash:

8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06

MD5 hash:

5ce25cf23a6b0d82d42bd25b525ab59f

SHA1 hash:

7f7031c45842d65206bdc2f11f4b591d9a58bc88

Link:

https://www.unpac.me/results/8513b65c-1904-4243-b7c9-3eb16028f5fc/

SH256 hash:

8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c

MD5 hash:

9b38a1b07a0ebc5c7e59e63346ecc2db

SHA1 hash:

97332a2ffcf12a3e3f27e7c05213b5d7faa13735

Link:

https://www.unpac.me/results/8513b65c-1904-4243-b7c9-3eb16028f5fc/

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8f6771fd6a56/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	NSIS Create hunting rule
Author:	kevoreilly
Description:	NSIS Integrity Check function

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

VIPKeylogger

exe 8f6771fd6a56527a9baa3a46cc626c09274b4b646b3c5e8f038c1f2fa1f40d06

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/91818/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample