MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7
SHA3-384 hash:	54483713497cc258b3ab60825ca9b054d5d8e8c2105890b0ce81896172889641585c48ff807a3a97b2e6e11a9fbc93dd
SHA1 hash:	b16277d05b3a588990a9fa0694f11dad46bb2c24
MD5 hash:	cd7c1b533b7529b42097500807540d8b
humanhash:	river-mirror-shade-network
File name:	cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	649'496 bytes
First seen:	2025-11-06 10:58:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	24f4223e271413c25abad52fd456a9bc (25 x GuLoader, 15 x Loki, 10 x RemcosRAT)
ssdeep	12288:l5DETI14UPaXKqlx+Gg6yBUu5OcjsTVOwf1+PZm:l5DETzlZ+kHGsTr+E
TLSH	T11ED402222314DC67EE620BB5943AFB6697366ED46CB1560367F57C33BB332538828614
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	08ac623332e06422 (2 x VIPKeylogger)
Reporter	adrian__luca
Tags:	exe signed VIPKeylogger

Code Signing Certificate

Organisation:	bennos
Issuer:	bennos
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-09-17T10:05:14Z
Valid to:	2026-09-17T10:05:14Z
Serial number:	2fda97a8f7236a7303e5357d4ed4f637e684f909
Thumbprint Algorithm:	SHA256
Thumbprint:	d971323c0bcb58f64fdc380b5606c0e822af2c7d537aa60f4da677004b7304e0
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7

Verdict:

Malicious activity

Analysis date:

2025-11-06 16:33:16 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b96f5a45-65ef-420e-8a11-2621e9cd3381

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/35962/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.ObfusRansom.bc.6542.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690c7f71ea0f3e915c238759

Tags:

injection obfusc virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Searching for the window

Creating a file

Creating a file in the Windows subdirectories

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-20T07:13:00Z UTC

Last seen:

2025-11-07T20:07:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7847c112-6d61-42df-b87d-b5a6040ab6ba

Result

Threat name:

GuLoader, Snake Keylogger

Detection:

malicious

Classification:

troj.evad.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1799961

Signature

AI detected suspicious PE digital signature

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/cd7c1b533b7529b42097500807540d8b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7/

Threat name:

Win32.Trojan.Kepavll

Status:

Malicious

First seen:

2025-10-20 11:08:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 38 (44.74%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zood2zk6x5vtyyubclfzyzn66gscy3m5jwydk5akl7febfdhcktq._file

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery keylogger spyware stealer

Link:

https://tria.ge/reports/251106-m3kmyazphv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

VIPKeylogger

Vipkeylogger family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8a40b980-eea5-4e8e-a63b-f87682b621b9

Unpacked files

SH256 hash:

cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7

MD5 hash:

cd7c1b533b7529b42097500807540d8b

SHA1 hash:

b16277d05b3a588990a9fa0694f11dad46bb2c24

Link:

https://www.unpac.me/results/6902f77f-b24e-4afe-a4b5-5c61ee4a287b/

SH256 hash:

6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

MD5 hash:

8cf2ac271d7679b1d68eefc1ae0c5618

SHA1 hash:

7cc1caaa747ee16dc894a600a4256f64fa65a9b8

Link:

https://www.unpac.me/results/6902f77f-b24e-4afe-a4b5-5c61ee4a287b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cb9c3d655ebf6b3c628112cb9c65bef1a42c6d9d4db035740a5fca40946712a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/35962/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample