MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9
SHA3-384 hash: f6634651949be97627d9d33ba0d0d506f17029fdbebff94469cfa21be68bcaa12a0a71bbead042a4342c6bbbe4ba6992
SHA1 hash: d4076e87042d4ddbbdef8e4f33d330f440562bc5
MD5 hash: a9ac099174ee8660897941672b13400e
humanhash: queen-september-charlie-nine
File name:17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:623'616 bytes
First seen:2025-07-07 15:06:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:7gr2/nb7k/OJ6i0elaxnDyG9gAZ6Gcy3bIYEbC1+7xaCz:B/nb7kUIxeyggNcqb5hI7xaY
TLSH T1A4D4F128339E8B03C6BB5BF61501D0B253B9BD8D6151D76A8FC26CEB7CB1B86050A717
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
31
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/13208/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686be2c7900df8e7f868520b
Tags:
virus spawn msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9/
Threat name:
Win32.Trojan.Jalapeno
Create hunting rule
Status:
Malicious
First seen:
2025-06-26 08:18:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7sdw5xuvggntp2pbyoxyi3tb2xq5bwcfdcpdxnqsynxhc7bm3mq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery execution keylogger persistence stealer
Link:
https://tria.ge/reports/250707-shjg2awwez/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2504dc8b-9bc7-4327-b001-248ddddd8c51
Unpacked files
SH256 hash:
17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9
MD5 hash:
a9ac099174ee8660897941672b13400e
SHA1 hash:
d4076e87042d4ddbbdef8e4f33d330f440562bc5
Link:
https://www.unpac.me/results/dc8517c9-29a9-4cb2-b442-e9fcf74b7ceb/
SH256 hash:
9efd46a9c5e3bf3e5625c298273414c245790d6fa8c12ace57f207b1205a92f2
MD5 hash:
1246936c5ace209606f50ac016bf0787
SHA1 hash:
6c459bae924c6d6574c780f8ef8606b23e767d34
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/dc8517c9-29a9-4cb2-b442-e9fcf74b7ceb/
Parent samples :
ee2c474d321d710e3e3d5808bde560a2bd3e94cef6d9b457149a2c3300972228
7e545a76c16dee6d24d3e86c6667c07bcd0f76064f232463b58fd4ec6d930090
71061c247762961b52c05043f9aad7acd24d6be55da97b79136685dc8d71fbcc
35bef5e9ce90087beef7cedaced82461cce0fd2571cb2d4d174a582939d9fde4
0b5155ade6b80a0f9988739163cdf89fdcd12868bab52cca60c7009cae8546af
17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9
b4a46f9be7587e5ca51f2a4c20e8fd08f39c2d0e36a9de245a11f90ef11fc08c
be6cfa96f2af2d275323fc9722c8bef9d4b0abd5716a7d344d6dc6ece60a72c5
cabe2979b93dece3c78479d593c5eaf90613e6fdeb33172b651e52f93b521caa
ccfb1cfc174940c9529f5acb8a19b66ffc570311fae21d4eae270434dfbe2513
SH256 hash:
c7d42b74708e271374d4d61535fe6accd4ec28ed175d16a57878edbf9524ba50
MD5 hash:
b87d675ceb75c58a17e9095cf30f310f
SHA1 hash:
8ca109c0c67b23a5a5b1e6e82f65a4e71af3be63
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/dc8517c9-29a9-4cb2-b442-e9fcf74b7ceb/
Parent samples :
ed99bc8b8fe39945058527720e8cbc838e305706ad4598bc5ce7aaddf3572f46
d8501442114f8a7c0bda23cd81250ed2ac9a2821a825bd9b814f09518c526922
0e222d955001ca2d7c51d16fbc43b7540941d36408663c53d178242c87b460b4
17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9
800b2d20d87be38e59ed0836a71820ff042a39c3087cfcaa26bd20d1e0db78d4
8f8421c7da42684b2bc1303af26cc656851ddb17facd21ef55c6173af960664e
SH256 hash:
077457a493d51812dcbb71fe26086a3c4f9ff3ad64aa120de9b50c3c9f7b1115
MD5 hash:
a7f8688688a9f41a2563986416e1c124
SHA1 hash:
ec7b401e5b84a8ec88493d77bd51999e760ac84b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/dc8517c9-29a9-4cb2-b442-e9fcf74b7ceb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/17e43b76f4a98cd9bf4f0e1d7c23730eaf0e86c228c4f1ddb0961b738be166d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/13208/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments