MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VIPKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba
SHA3-384 hash: 8d0cdd602ef0aa3fc2c2b3a5aa45e6d651d3ee10779d456808cf2f7840a96dc4aa0ccb2fe878d10bac7a43fd2a16919e
SHA1 hash: 9cff284042166495e20428500545b99330a1a9c8
MD5 hash: 21eb0bfd14e8ab29a3c29d5b60ee09e1
humanhash: mobile-july-robin-north
File name:f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba
Download: download sample
Signature VIPKeylogger
Create hunting rule
File size:574'016 bytes
First seen:2025-01-10 14:15:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4f67aeda01a0484282e8c59006b0b352 (51 x GuLoader, 9 x RemcosRAT, 9 x VIPKeylogger)
ssdeep 12288:n93jlz5CwkzUf1DYt/itWe7NAZSfR6IWAKsbk1B8B:n93jlzcxzUf9S6tx7mWKNeoiB
TLSH T136C4D094A6A68921C69D423496937A1EC27C9FD612E6D012FB357D33FD317ADBF00283
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter adrian__luca
Tags:exe signed VIPKeylogger

Code Signing Certificate

Organisation:Ostracodan
Issuer:Ostracodan
Algorithm:sha256WithRSAEncryption
Valid from:2024-07-07T10:52:20Z
Valid to:2025-07-07T10:52:20Z
Serial number: 5a1a07f6fcdee04b4565543f9b3f3021334c2cd4
Thumbprint Algorithm:SHA256
Thumbprint: ac059a02877cb12bf003984c12ec558cbb049ba677390eb6c71707b4ded59aa5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
307
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba
Verdict:
No threats detected
Analysis date:
2025-01-08 15:21:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/20766630-8f58-4f4c-9b80-8ba7eb6a5681

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.13593.14548.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67812b851e9cdec7dbbb7366
Tags:
obfuscate virus shell nsis
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file
Launching a process
Searching for the window
Searching for the Windows task manager window
Using the Windows Management Instrumentation requests
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context installer microsoft_visual_cc overlay
Link:
https://www.filescan.io/uploads/67812ba20e6ff2c7570328dd/reports/5954109a-e5e6-4e05-8d6d-93bf1c1d21ef/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NSIS
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d5566b5a-0ec7-433f-9211-bd2fa439071e
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1588867
Signature
Early bird code injection technique detected
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1588867 Sample: lkETeneRL3.exe Startdate: 11/01/2025 Architecture: WINDOWS Score: 100 25 reallyfreegeoip.org 2->25 27 api.telegram.org 2->27 29 6 other IPs or domains 2->29 41 Suricata IDS alerts for network traffic 2->41 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 51 4 other signatures 2->51 8 lkETeneRL3.exe 26 2->8         started        signatures3 47 Tries to detect the country of the analysis system (by using the IP) 25->47 49 Uses the Telegram API (likely for C&C communication) 27->49 process4 file5 21 C:\Users\user\AppData\...\Peltandra.Ove, Unicode 8->21 dropped 23 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->23 dropped 53 Suspicious powershell command line found 8->53 12 powershell.exe 28 8->12         started        signatures6 process7 signatures8 55 Early bird code injection technique detected 12->55 57 Writes to foreign memory regions 12->57 59 Found suspicious powershell code related to unpacking or dynamic code loading 12->59 61 2 other signatures 12->61 15 msiexec.exe 15 8 12->15         started        19 conhost.exe 12->19         started        process9 dnsIp10 31 api.telegram.org 149.154.167.220, 443, 49995 TELEGRAMRU United Kingdom 15->31 33 jovannovicvoce.com 151.80.4.227, 465, 49996 OVHFR Italy 15->33 35 4 other IPs or domains 15->35 37 Tries to steal Mail credentials (via file / registry access) 15->37 39 Tries to harvest and steal browser information (history, passwords, etc) 15->39 signatures11
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-12-19 09:05:16 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6rm4jethcztghcezuxc5ofstr3h7guldhds45jsolvj7uqq6yk5a._file
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger stealer
Link:
https://tria.ge/reports/250110-rkmf2aynbp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Blocklisted process makes network request
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
VIPKeylogger
Vipkeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7808466522:AAFleMCkdYBjkW3SQRMH5osM11THNEIFjRA/sendMessage?chat_id=7161037710
Verdict:
Malicious
Tags:
loader guloader
YARA:
NSIS_GuLoader_July_2024
Link:
https://app.threat.zone/submission/affe7fea-8cd6-4c13-a7cf-2e8a8487b3fd
Unpacked files
SH256 hash:
12d0653de211a1b096f8f5ccb41bdd7921373241851d8d7b087c0fc065067d5e
MD5 hash:
6c5df6fa478deca09c7c0904d9eaeb86
SHA1 hash:
274b2387a8081da73480c4ceb4441d34f1297b69
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/0092011b-0665-43f0-9536-3753ef1c4dfc/
SH256 hash:
f459c492671666638899a5c5d716538ecff3516338e5cea64e5d53fa421ec2ba
MD5 hash:
21eb0bfd14e8ab29a3c29d5b60ee09e1
SHA1 hash:
9cff284042166495e20428500545b99330a1a9c8
Link:
https://www.unpac.me/results/0092011b-0665-43f0-9536-3753ef1c4dfc/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::SetFileSecurityA
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteA
SHELL32.dll::SHFileOperationA
SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDiskFreeSpaceA
KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileExA
KERNEL32.dll::MoveFileA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExA
USER32.dll::OpenClipboard
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments