MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VIPKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712
SHA3-384 hash: f4b700fd7f6bcd217e91fd91b47671f15f9fba072dd4291c9c44f96ae45efa55e4999994231ea022357c20c33cfd9dac
SHA1 hash: 630a6b17d1e4d2b4cddb0cb12d7ffd4ee6855b53
MD5 hash: cbfeb2ac1cc37bbc45105aff897d5fba
humanhash: sierra-west-one-aspen
File name:dump.dll
Download: download sample
Signature VIPKeylogger
Create hunting rule
File size:294'912 bytes
First seen:2025-02-13 11:55:52 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 6144:8wOisRx5VPVaSEeGogs0sU2giY44e2kV2NpHPLVpQ2Ts9B3RboUZub:9OisRx5VPVaSEeGogs0sU2giY44e2kVi
TLSH T10B54A62D2FD8EC00F7BF453792B95024C676B05305748E2E1AE2E4252E7EA05AE46FD7
TrID 68.6% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
21.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
3.0% (.EXE) Win64 Executable (generic) (10522/11/4)
1.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter cedricg_mirror
Tags:dll RedLineStealer VIPKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
482
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-10008460-0
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67addddfa0fd713c335ab73e
Tags:
virus smtp msil
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd cryptor_detected evasive hacktool lolbin netsh obfuscated packed stealer stealer
Link:
https://www.filescan.io/uploads/67addde1de5f893502e0266a/reports/7df7595f-eac6-466d-b87d-5a02029b1a53/overview
Verdict:
Malicious
Labled as:
MSILHeracles.NotFoundKeylogger.Generic
Link:
https://www.hybrid-analysis.com/sample/af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9c89d245-c158-4a4e-82e4-4abab9c92e2d
Result
Threat name:
VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1614211
Signature
.NET source code contains potential unpacker
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1614211 Sample: dump.dll Startdate: 13/02/2025 Architecture: WINDOWS Score: 76 15 Malicious sample detected (through community Yara rule) 2->15 17 Multi AV Scanner detection for submitted file 2->17 19 Yara detected VIP Keylogger 2->19 21 2 other signatures 2->21 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Score:
89%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712/
Threat name:
ByteCode-MSIL.Keylogger.NotFound
Create hunting rule
Status:
Malicious
First seen:
2025-02-13 03:41:16 UTC
File Type:
PE (.Net Dll)
Extracted files:
3
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v5zexknyrheqflreqa42so4g2u3bhxewnzsi4t7fjsrlcdiou4ja._file
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger discovery keylogger stealer
Link:
https://tria.ge/reports/250213-n34aqaxrfw/
Behaviour
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Downloads MZ/PE file
Unpacked files
SH256 hash:
af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712
MD5 hash:
cbfeb2ac1cc37bbc45105aff897d5fba
SHA1 hash:
630a6b17d1e4d2b4cddb0cb12d7ffd4ee6855b53
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Link:
https://www.unpac.me/results/98ba38fd-28a5-4633-ad5a-e5d915322429/
Parent samples :
6c6df909a12aa572bc7f7ba7a1274503a8f3860fec5223f08017e51f2d2fb9a5
f77786d716bdf01be933a41a2315e1db3d671e99cc7f2bcae148869becd52fe0
739a86b464bb1710cc2a5cb2b5eee3596a548c962c0f7cc1a8df9b1d0a5bde07
420f888c8bc5a5e5c71b6c157e7a8ed83527bb4893605f7c827cccd89f286cbc
af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712
SH256 hash:
1fb8697263c628462df2b31d2213f38d673c4b06b8e03ee6770726eaad088fc3
MD5 hash:
c3372197c68e44f7d2984d691cd3174e
SHA1 hash:
c61c2177b46768ef3701192b69769351e6f91890
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Link:
https://www.unpac.me/results/98ba38fd-28a5-4633-ad5a-e5d915322429/
Parent samples :
6c6df909a12aa572bc7f7ba7a1274503a8f3860fec5223f08017e51f2d2fb9a5
f77786d716bdf01be933a41a2315e1db3d671e99cc7f2bcae148869becd52fe0
739a86b464bb1710cc2a5cb2b5eee3596a548c962c0f7cc1a8df9b1d0a5bde07
420f888c8bc5a5e5c71b6c157e7a8ed83527bb4893605f7c827cccd89f286cbc
af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

RedLineStealer

Executable exe 420f888c8bc5a5e5c71b6c157e7a8ed83527bb4893605f7c827cccd89f286cbc

VIPKeylogger

DLL dll af724ba9b889c902ae248039a93b86d53613dc966e648e4fe54ca2b10d0ea712

(this sample)

  
Link
https://github.com/cedricg-mirror/reflexions/edit/main/CyberCrime/Redline_Stealer/420f888c8bc5a5e5c71b6c157e7a8ed83527bb4893605f7c827cccd89f286cbc/README.md
  
Dropped by
SHA256 420f888c8bc5a5e5c71b6c157e7a8ed83527bb4893605f7c827cccd89f286cbc
  
Dropped by
MD5 c1911f9e3d8f752586fc39f5554de194

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments