MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfdd7bb776c5875ea750bdbcb5a4f00d56b3d219aa50d229fc7047f90d2c0419. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dfdd7bb776c5875ea750bdbcb5a4f00d56b3d219aa50d229fc7047f90d2c0419
SHA3-384 hash:	bb53f9accbb7ebe49519e224d8d093baca1175a5bf194f25ce2545bcfd96b6d48cce668657e582df4a60b10664ead63e
SHA1 hash:	8581fb10da8d58e4036445ed615d85d65f0b5d87
MD5 hash:	0943f8ed9154b6cbf8a848f71144971b
humanhash:	one-bravo-dakota-autumn
File name:	Velimed_Group_Booking.js
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	1'058'922 bytes
First seen:	2026-08-20 03:15:55 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:N7sSKD8KBmTg7skWyjBmTBmTv0mTWyjWyj9g7sVLg7suM5yjBmTvycuykD6SKWy0:47Nmn+tGoR7/meoKe2oL
TLSH	T1B4356C4AB760B08B5936263BDC9F2D2313B507772EF03614781D5E80A1366EF9772B62
Magika	javascript
Reporter	ppppt
Tags:	js keylogger VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

150

Origin country :

TH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a86718a27225b84743bc4d6/reports/215ee685-f7d5-4b69-b344-6891c0d7c649/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/dfdd7bb776c5875ea750bdbcb5a4f00d56b3d219aa50d229fc7047f90d2c0419

Nucleon Malprob Benign

Score:

12%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/dfdd7bb776c5875ea750bdbcb5a4f00d56b3d219aa50d229fc7047f90d2c0419

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dfdd7bb776c5875ea750bdbcb5a4f00d56b3d219aa50d229fc7047f90d2c0419/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-20 03:16:27 UTC

File Type:

Binary

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=37oxxn3wywdv5j2qxw6lljhqbvllhuqzvjinekp4obd7sdjmaqmq._file

Threatray VIPKeylogger

Verdict:

malicious

Label(s):

VIPKeylogger

Alert

Create hunting rule

Link:

https://reports.threatray.com/af793d84-1dcc-413f-a5a5-47eafddfd57c

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery execution keylogger stealer

Link:

https://tria.ge/reports/260820-dsm6msyfna/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Badlisted process makes network request

Family: VIPKeylogger

Process spawned unexpected child process

Malware Config

C2 Extraction:

https://api.telegram.org/bot8690461120:AAFZn16zpaFYhkHVuADufcddzABHlICIrXo/sendMessage?chat_id=7388953110

Dropper Extraction:

https://long-wildflower-b4f5.gustavosoftware.workers.dev/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/dfdd7bb776c5875ea750bdbcb5a4f00d56b3d219aa50d229fc7047f90d2c0419