MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336
SHA3-384 hash: ab93a79e5ced6ca4d9d1f18221187b35870a4057762dc9bce51330614694d59a9f8370b31e628fc1c9c24808cfc289ef
SHA1 hash: 9252177d7c99de1e87fcd7661741e976a19a2292
MD5 hash: d57203867e10c0725e229b83b6ef5518
humanhash: eight-mango-magazine-cold
File name:SOA.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'412'096 bytes
First seen:2025-03-27 16:47:39 UTC
Last seen:2025-04-08 08:52:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:8jm0AIjvtUwH1I1yFXANOF2v/7JvsZucLDwdXwUcYFQSdNmghfBy:8mIjn1IoFXjF2FvsZ3XwxwqqwNy
Threatray 5'056 similar samples on MalwareBazaar
TLSH T1B565BE45D3C8BC89C00B1172A87DF634291EFB59A27BCD2E265A783565A73933067F0E
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon d480aa8e96968ed8 (20 x AgentTesla, 15 x SnakeKeylogger, 13 x MassLogger)
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
525
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA.rar
Verdict:
Malicious activity
Analysis date:
2025-03-27 14:41:35 UTC
Tags:
arch-exec snake keylogger evasion telegram stealer
Link:
https://app.any.run/tasks/394f7cb4-cceb-46d9-80d1-9fe6de384d69

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Msilheracles-10017859-0
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67e58156c471d02ff53e083b
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Stealing user critical data
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated obfuscated packed packed packer_detected smartassembly smart_assembly
Link:
https://www.filescan.io/uploads/67e5815cf274bf2d8e25d0d6/reports/db70a9ab-7cbe-4d5b-80d5-856ea93ccd62/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7cd6f449-c2b8-433c-9cf0-ac89a44a9d8b
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1650418
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336/
Threat name:
ByteCode-MSIL.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-03-27 14:57:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bqljlj6cd2kvv6cayzrho6ujdjfmsu67qekudjnanr4hkgmukm3a._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
46811ff66868e4f3febe3a5f2374997ea2b1d407f15ffc269444b6fbc431dda1
SnakeKeylogger
5ce0f0aea4c4aae607838cd574a6860e8745ed8eade9dc6156864ac5c521c944
SnakeKeylogger
804cb8891f2829caf32366e9efbbeedd19eab55288ca94702d1c29ffded6d463
SnakeKeylogger
c8da1a4a776aba5100c4dc921d3c048088bcc9bded8676237454c8fa0d51cf9d
SnakeKeylogger
e5c3febab37a06659361fbfb93aff167b685270ba63a71a86fa9892379abfbf3
SnakeKeylogger
error
SnakeKeylogger
+ 5'046 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger stealer
Link:
https://tria.ge/reports/250327-va8s3avwfz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Suspicious use of NtCreateUserProcessOtherParentProcess
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
Win.Packed.Msilheracles-10017859-0
YARA:
n/a
Link:
https://app.threat.zone/submission/da66fcc4-c6c3-4f5e-9820-f02ac57d7f55
Unpacked files
SH256 hash:
0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336
MD5 hash:
d57203867e10c0725e229b83b6ef5518
SHA1 hash:
9252177d7c99de1e87fcd7661741e976a19a2292
Link:
https://www.unpac.me/results/681cc184-78df-4d8b-8173-e0a0bac55e06/
SH256 hash:
70236d9d939d1d7f880a909891274393fc0e1f7823c0653ba95761eec5423ee7
MD5 hash:
369d76332aacdf3ba06c0f5f9df60d7d
SHA1 hash:
a7a317aaff53bb6f41ee9c9f529072e777b9ad8e
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/681cc184-78df-4d8b-8173-e0a0bac55e06/
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
Link:
https://www.unpac.me/results/681cc184-78df-4d8b-8173-e0a0bac55e06/
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/681cc184-78df-4d8b-8173-e0a0bac55e06/
SH256 hash:
d930e888b1310a328b7f4a2d78e0d40316d64cbd720af799b2b425a01a54886d
MD5 hash:
bb8c58c15c4047849c6b633a7239f4e1
SHA1 hash:
c8d5be19c64cdaa95724037255022512203e9c38
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/681cc184-78df-4d8b-8173-e0a0bac55e06/
Parent samples :
0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336
263d05e70b0f36ce77ce40d0ef33b6b3415aabdecd137875bbf550416e627860
df09c973d909e98570ae5724aa1ce512a212a08aa7d2b700e0d17e1bb5f0393b
95f039b672f79ed30932930cc8d4b7e6c27b9014d931cdda8d7696094c97da93
cd5974112fee104dc4d824e40ae81dcfe57e19175c6cc83726d6141c99114b2a
89f5d7f609165a5b50de6dcf9a60a91b012d282a58d33d0bb08dab54b5b59706
SH256 hash:
c7bfd1ef411ea9a741a3e18b699118d7a880758336b5caa98bf85362694b87fa
MD5 hash:
9ab4255a950e5a540ecc75a363e83262
SHA1 hash:
cfb800479e202db0c04630e70f2ce8d24962c205
Link:
https://www.unpac.me/results/681cc184-78df-4d8b-8173-e0a0bac55e06/
SH256 hash:
9ffe3af5116f5ac9deb3a72a6602862694c88398301aa1bc0654d9735598300e
MD5 hash:
864d625edf128eba55ddca676ae22f9c
SHA1 hash:
d97b820731df76ec90e0be977da27c3764551334
Link:
https://www.unpac.me/results/681cc184-78df-4d8b-8173-e0a0bac55e06/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0c1695a7c21e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 0c1695a7c21e955af840c662777a891a4ac953df811541a5a06c787519945336

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments