MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VIPKeylogger

Vendor detections: 12

Intelligence 12 IOCs YARA 3 File information Comments

SHA256 hash:	dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945
SHA3-384 hash:	2d955c650be6096bb80e906b2dc1019cd565eb9cd19183b106a2251eb45ba782a09baac2e3dbb9c44e27aaeea1cbf7e3
SHA1 hash:	7196d0336f7e32adbe60bafa6ce2fe4f12d02060
MD5 hash:	8cae4db76c0f9e697ffb39577c1f4a53
humanhash:	social-gee-april-india
File name:	LACK.ps1
Download:	download sample
Signature	VIPKeylogger Create hunting rule
File size:	122'978 bytes
First seen:	2026-04-23 23:06:13 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3072:ByBiZ644dykUmuZNWrn2OhP/OH1C1tMvkwavJpMceTJg4MVOs:B/Z54kNNwn/KorFhqcelg4C
Threatray	2'797 similar samples on MalwareBazaar
TLSH	T12AC312302AC9C9DF1CD74D6121AF499EFB9903CD501AB6993E5CC0CB8A2700F2DF9456
Magika	powershell
Reporter	BastianHein
Tags:	ps1 VIPKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Script.SNH-gen.87652253.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69eaa60a51cce3ff702f76ec

Tags:

emotet shell sage remo

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

aes base64 crypto encrypted evasive obfuscated powershell

Link:

https://www.filescan.io/uploads/69eaa5fd8a82359247af6058/reports/45ae7da2-35a4-45d6-acd8-5639deb22412/overview

Verdict:

Malicious

Labled as:

CMD:BZC.PZQ.Boxter.441

Link:

https://www.hybrid-analysis.com/sample/dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-15T01:45:00Z UTC

Last seen:

2026-04-23T20:31:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.HTA.a PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945/results?tab=lookup

Score:

70%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945/

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-04-23 23:07:33 UTC

File Type:

Text (PowerShell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3lat2lll7jnq3kj2jm33si5zt2ed4kwqpm3wu3iiclr5fygeffcq._file

Verdict:

malicious

Label(s):

vipkeylogger

donutloader

VIPKeylogger

28613bfb4e866186133235a88e318df3059b01001f297ad6a524eab0885305a5

VIPKeylogger

32bdc14b86e8ed0f0ca375f34550c97a6ad85de7f8417e6e76f570f8d91422b6

VIPKeylogger

40d804b9813d3a6d40b7f33db2c2a09eeeff1b06413f2dfb06442176b4589b9f

VIPKeylogger

5364a6db5cfb43f056be8dd0102124a425bd7b02c406b2f4af822b3e18106144

VIPKeylogger

61061bd61fd9b9abc52c6041993114456744e4bde92f22423daea647b7f02c5b

VIPKeylogger

74de71d06d873e0cc8d6d92c2a340a6b7be6f5867772edf7790bff0297814636

VIPKeylogger

77507a11e22c4276f550c19e8ce4fcbeadb0cc1caf1f90d7a6a0d5c5ea9af9e6

VIPKeylogger

c1ac4217e48ba5dcd89a543db47563a12b7e402193145d7d71ae7b3351cad47b

VIPKeylogger

d2ab8dcab70822c839912cb672e93de459e5608bea210c78a1be56b54cbd8f81

VIPKeylogger

error

VIPKeylogger

+ 2'787 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:donutloader family:vipkeylogger collection discovery execution keylogger loader stealer

Link:

https://tria.ge/reports/260423-23mjvshx5n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Detects DonutLoader

Family: DonutLoader

Family: VIPKeylogger

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample