MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 17

Intelligence 17 IOCs YARA 19 File information Comments

SHA256 hash:	144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b
SHA3-384 hash:	5d1cbcabcaa5d0e97d8c4b12fcfcdb4c7b5a874d7511abb4760bf7ec9a99e31a262c1761bc75efa0551233d22b7d377c
SHA1 hash:	f399788761438c303e3fa8fce01e3581fda1f66a
MD5 hash:	1c014954b67794a3b1876c718d34a053
humanhash:	johnny-west-seven-cold
File name:	144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	704'512 bytes
First seen:	2025-09-05 12:44:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:sD1eW7CyQo1TH54yFcqBnWkIipabpfxXcKWfcEDtMktEvKI/5Bn7mF:sJeWOfo1TH+oIipabRxsKWPZdy
Threatray	306 similar samples on MalwareBazaar
TLSH	T1EDE4F1656213CBC2C0D557FC58B1EF79136B4E886820DF3A9ADD7EAB3F267041E80625
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b

Verdict:

Malicious activity

Analysis date:

2025-09-05 16:27:32 UTC

Tags:

evasion snake keylogger netreactor stealer auto-sch-xml

Link:

https://app.any.run/tasks/722bd5b8-f1ff-4a74-9508-85ca2eb78b42

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/25428/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68badb82eb163e0ec1847cdd

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Stealing user critical data

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/68bae3df37c25fcf12d4c248/reports/f2d12cb3-4522-4adc-a2bb-00447480e83d/overview

Verdict:

Malicious

Labled as:

Genie.8DN.Generic

Link:

https://www.hybrid-analysis.com/sample/144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-08-18T04:10:00Z UTC

Last seen:

2025-08-18T04:10:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d822608a-c5c1-43b1-9a02-57c2a68fa506

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b

Verdict:

inconclusive

YARA:

7 match(es)

Tags:

.Net Executable Html Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.16 Win 32 Exe x86

Link:

https://app.malva.re/file/1c014954b67794a3b1876c718d34a053

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b/

Threat name:

ByteCode-MSIL.Spyware.Snakekeylogger

Status:

Malicious

First seen:

2025-08-18 08:01:37 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=crgammhmepxslernll2ay52uzqampy2567wa7ly7xkah4nsad4nq._file

Verdict:

malicious

Label(s):

404keylogger

unc_loader_037

SnakeKeylogger

6c291112aed1fd2f2b054084cf167a877a1f47410208a5460c2b2a173d06311c

SnakeKeylogger

6ef10a2b79a761a18c6351d623cc52ef989a6ab06b37fdb07f5fb473b1c05c2b

SnakeKeylogger

e40ed83719528313ef5d65bb1ab4db9226a5e3d7421863f3375d94243db78049

SnakeKeylogger

+ 296 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection discovery execution keylogger persistence spyware stealer

Link:

https://tria.ge/reports/250905-qkgp4sam4y/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/69a7febc-4092-455d-88d7-826cd260478e

Unpacked files

SH256 hash:

144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b

MD5 hash:

1c014954b67794a3b1876c718d34a053

SHA1 hash:

f399788761438c303e3fa8fce01e3581fda1f66a

Link:

https://www.unpac.me/results/eaa1145f-caba-47fa-9ce9-f81978e0661c/

SH256 hash:

e833b4c040a54da76ec316ed0a58bd962c104ecfaf27de4113af7d3e7246a3a9

MD5 hash:

ad7cf108545cde32ec3ee332ce267e83

SHA1 hash:

39aeb72728b1c9e64593766e73435886fdd485b0

Link:

https://www.unpac.me/results/eaa1145f-caba-47fa-9ce9-f81978e0661c/

SH256 hash:

f16d6c55b649c1d25adcd2d8d9464cfdae7b5487c39df6b683ec5d564d1f3b71

MD5 hash:

94ccae0ba951db1641b93df5b2151592

SHA1 hash:

603e2211be99db3dc7c1a005a5290125d1d2d001

Detections:

win_404keylogger_g1

snake_keylogger

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

MALWARE_Win_SnakeKeylogger

Link:

https://www.unpac.me/results/eaa1145f-caba-47fa-9ce9-f81978e0661c/

Parent samples :

b9fc45e7dce50f5e1c620d0f42120c3dd4f2ecc309d2b299e3599e06bfded85f
4202f9550135e4c30d032ff81637ce43a539620da33cb5b7c7ea07c4555e7033
3ca0de0f3ea53b9254aea3c5fe9e604e189236b2c918096acf837583f9205587
6bfefb0f3b8a878aec69c3d830824c3bf7d5181ffd6d6e88dc4a8d793370c233
2ef20b579a88f614a0e4235fce18ebc6a8dc2c0e73f3d152826ff173a963a44a
16cdb69b5e6d2903d654ffced05bd03d303587db0f307137d8a588138a658b3d
bc50ae7aa9d0ebbabd5e6405dc7317b42e10f5559bb8e0e422c7b9ca5d38e231
81467731cad7caa88c63f9cc0949efd53c6e0853eda90cab81993a2e567de8cd
144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b
0201652520917243e47dbe8f9b2d32b4bb1764b9398426c097ea6d2e993a3750

SH256 hash:

cb2e6fc2ec1aad5560868088a246f8eb650b17d954f2b97f1545e72a6e672847

MD5 hash:

a2f436f2529ad350244d50a9bc92cab4

SHA1 hash:

90da49e524ae8fcae50f19fc0d331ca1f4525b1b

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/eaa1145f-caba-47fa-9ce9-f81978e0661c/

Malware family:

zgRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/144c0630ec23/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/144c0630ec23ef25922d5af40c7754cc00c7e35df7ec0faf1fba807e36401f1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/25428/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample