MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VIPKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495
SHA3-384 hash: 8fdf7e039dc78b994b307bddbc9504b4d7bb0fc9463d476a689daa2c0f228450ee55249e69c55314a40b0ee85b05a57c
SHA1 hash: 0ee0faebb154177cf6675345281ccaf89a575361
MD5 hash: 7d087ed8ee01697586d3001aa932f2d9
humanhash: johnny-kentucky-beryllium-louisiana
File name:SecuriteInfo.com.Trojan.PackedNET.3393.23258.20719
Download: download sample
Signature VIPKeylogger
Create hunting rule
File size:734'208 bytes
First seen:2025-08-20 05:16:28 UTC
Last seen:2025-09-05 12:59:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:a7JQvACAG65hCkN+AuPNFpxPIzpoJoAUd4y6ryiGQw4awo3PMO0E5hhan2:IJQICo+PFVQ9omFdiG7QXs
TLSH T107F412542696EA12C5F637F41960E3B883FA7EAE7412D3025FD9BDEB3821B405C90793
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe VIPKeylogger

Intelligence

File Origin
# of uploads :
6
# of downloads :
52
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0154d84d9bd30d51ed531956a6c9a9bff4c78761c06468a9f125abbc76adbced.zip
Verdict:
Malicious activity
Analysis date:
2025-08-20 03:56:27 UTC
Tags:
arch-exec netreactor evasion snake keylogger telegram stealer
Link:
https://app.any.run/tasks/ebb59c6f-ba89-4e3f-8d6f-e61f80c1b75e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/22380/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3393.23258.20719.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a55a43c2f5296a1a285f56
Tags:
virus spawn shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Launching a process
Creating a file
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
explorer lolbin obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68a55a3ca4bdac9f5b9fe691/reports/389e17d1-4840-4640-8965-e67f82ddace2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c9164f56-0ded-4d56-bb4a-32d1b20acb8d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.37 Win 32 Exe x86
Link:
https://app.malva.re/file/7d087ed8ee01697586d3001aa932f2d9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-08-20 00:36:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5vt6ge4fnusn37z2wxjs67aaqci5xkdxzsa4edzddek53rd2uskq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
VIPKeylogger
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection defense_evasion discovery execution keylogger stealer
Link:
https://tria.ge/reports/250820-fyhjfsbn31/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Modifies trusted root certificate store through registry
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/34ca4101-9e3c-401b-baf4-a97f3dad7226
Unpacked files
SH256 hash:
ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495
MD5 hash:
7d087ed8ee01697586d3001aa932f2d9
SHA1 hash:
0ee0faebb154177cf6675345281ccaf89a575361
Link:
https://www.unpac.me/results/7668c136-08d6-4add-838b-5975d6d6b407/
SH256 hash:
7b90dfa5a1e1cb97014bb839dfe66577109a9bfdebf37a1d943747fd6297ec54
MD5 hash:
175a8b2e9d8e3bf7a1920fc6b93371f4
SHA1 hash:
054b4bc3e37be1e79020b0a49fcbb308a5ce2916
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7668c136-08d6-4add-838b-5975d6d6b407/
Parent samples :
17e0c7518d7529f547024299249ba52280ef8832a59065b51084d2363735f0c3
ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495
7d3c778bdf96a09329ff48320375c3b3f902fb0c60a6dcc3e84c74c29a925ad7
b825530e6ae318301d55258b6cb986139eb8305282ec8f2d5c10ddd85372b5e8
585f964ab32e7e8b968f4d6f3c8395d757abc7bd22afc3ea04f31fd381fb4c5e
e716163f54adee3d2033774eb284550be239f8fa3027ce66724173f822a1131d
b61f96d853d5363fbd77d8b465c9394bb606c7e5e44717aa9230098c2caea281
f94f36ad5e8746f9b9dd6a23e079d8d12f0e55d49a96c761cba4b9bbde734f04
bb17aae78c989184f3618223ea0e06d307fee6a6467ba61bb4b9e15ca42cf06c
2e6ea2095b92809d61b9033fea61c32f672aedda1d736b6a38925ca19d27c16d
SH256 hash:
432268b926c1061c8ffb45c3f3a7764c8bcf3904ef68f3fd4445bf449cc29439
MD5 hash:
0db2259567514ee489f2c5cde524cf42
SHA1 hash:
35b81599c650121b9df346bdd00948580588f4a2
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/7668c136-08d6-4add-838b-5975d6d6b407/
Parent samples :
ffc45b80b1fc40415c69b170cdf563b268bfb5653e17c83f6d3722b7f6cfe391
3f46a75587e018a147f031be7f79a40aced7c86a6d1313fd34df8cdafec90376
ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495
d9b561166f1a4217a18c9af81de9dbf9df53a86747993a7c931535761df37f42
9454ed7dab210e18bef21b1c59a2736a65ced61892df6299fdcf743cce638bcf
SH256 hash:
02773de6cb4dc43a3d8df83450482e5c7e4e8374beb4ba3b6d5229b0b00a148f
MD5 hash:
004519e1f358d4f6e6f27ed8c44ea54e
SHA1 hash:
d0c9713fd5c3af91c0ff980784874a4ae637017e
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7668c136-08d6-4add-838b-5975d6d6b407/
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ed67e313856d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/22380/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments