MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8a4f471ed9635a51256a8b6ed268465cf3ead6de73baf88761944cd8802aa8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c8a4f471ed9635a51256a8b6ed268465cf3ead6de73baf88761944cd8802aa8e
SHA3-384 hash:	0cff472eeb7f3fbf8ccda5a2886bebba5c89f3cfeefc19e0bafa5ed129312920a6758b7f5f40f06975b20bc36b77ca85
SHA1 hash:	21bf43f0393e849193203dd868046e4954666b1f
MD5 hash:	223999dbe800bd49cf9a2bed6d2e199b
humanhash:	alanine-kentucky-skylark-fix
File name:	PO-102F4S SITCVN.js
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	48'296 bytes
First seen:	2026-10-09 14:58:50 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:4bmPFqLAzjVx7iXtCR5fxg9ZUBCmInQE8:4bGFJxYCBCrQE8
TLSH	T1C9234383FB6102866C515B0E2BEFFB9B75951833321C2265386CD915246FB83642FFB9
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	js VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

167

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.63813938.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6ac9014e75b484cde03309a6/reports/55b1b5ec-523c-4a76-9a07-d6e49840b59e/overview

Hybrid Analysis Trojan.Tr

Verdict:

Malicious

Labled as:

Trojan.Tr

Link:

https://www.hybrid-analysis.com/sample/c8a4f471ed9635a51256a8b6ed268465cf3ead6de73baf88761944cd8802aa8e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-10-09T05:36:00Z UTC

Last seen:

2026-10-11T12:54:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/c8a4f471ed9635a51256a8b6ed268465cf3ead6de73baf88761944cd8802aa8e/results?tab=lookup

Joe Sandbox VIP Keylogger

Result

Threat name:

VIP Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1984910

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus detection for URL or domain

Creates processes via WMI

Drops script or batch files to the startup folder

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Powershell connects to network

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Drops script at startup location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected MSIL Injector

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

55%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/c8a4f471ed9635a51256a8b6ed268465cf3ead6de73baf88761944cd8802aa8e

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c8a4f471ed9635a51256a8b6ed268465cf3ead6de73baf88761944cd8802aa8e/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-09 08:37:44 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 38 (26.32%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zcspi4pnsy22keswvc3o2juemxht5lln44527cdwdfcm3cacvkha._file

Threatray VIPKeylogger

Verdict:

malicious

Label(s):

VIPKeylogger

Alert

Create hunting rule

Link:

https://reports.threatray.com/1e6b5a42-3a5f-4731-a788-487df1c9f3f8

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery execution keylogger persistence privilege_escalation stealer

Link:

https://tria.ge/reports/261009-scxsgaysfy/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Creates a file in the Startup directory

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: VIPKeylogger

Process spawned unexpected child process

Malware Config

C2 Extraction:

https://api.telegram.org/bot8605662882:AAGOi8tNnOtTj4sPeFNCHThH6IZ5Lh938lQ/sendMessage?chat_id=8008584601

VMRay VIPKeylogger

Malware family:

VIPKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c8a4f471ed96/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.