MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045
SHA3-384 hash: 5a219ee41f0893bd669965acf81f91091c2200ef76b8d090a76962fa6136aed9826c772f21b46db98bfb18a68d238d60
SHA1 hash: 25debaf7d15ea0e6ffb08372018bba1ee9ce6498
MD5 hash: 1ce456b9a0cd7d650cdcae322b9af6c7
humanhash: uncle-wyoming-maine-item
File name:567876788767765.CMD
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:163'169 bytes
First seen:2025-11-04 17:07:15 UTC
Last seen:2025-11-07 16:25:33 UTC
File type:cmd cmd
MIME type:text/plain
ssdeep 3072:qaE6yVB1Yx7WREZEpEwS6xyWsVyXSt1CKuG/vdo:rE6yVB1Yx7iqEpEw1M9iSeKuai
TLSH T19CF306EE8574ECC02329FC9054352A4632846A739EB03A2CAFE14FFEDC5B55CCB65658
Magika batch
Reporter smica83
Tags:cmd SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
68
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BAT.Obfus-8.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690a32ec706befaf4ecbad2b
Tags:
obfuscate xtreme shell
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 evasive obfuscated powershell
Link:
https://www.filescan.io/uploads/690a32e7393eed3f38e3840a/reports/1e0faff7-3c72-4b89-a1de-2bd04e6c5185/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-04T14:22:00Z UTC
Last seen:
2025-11-04T23:37:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.BAT.Tesre.gen Trojan-PSW.Win32.Stealer.sb Trojan.Win32.Agent.sb Trojan.BAT.Agent.sb Trojan.PowerShell.AmsiBypass.sb Trojan-Spy.MSIL.SnakeLogger.sb Trojan-PSW.Win32.Stelega.sb HEUR:Trojan.PowerShell.Tesre.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045/results?tab=lookup
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1807945
Signature
.NET source code contains a sample name check
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Bypasses PowerShell execution policy
Drops script or batch files to the startup folder
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious PowerShell Parameter Substring
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Powershell decode and execute
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1807945 Sample: 567876788767765.CMD.cmd Startdate: 04/11/2025 Architecture: WINDOWS Score: 100 94 reallyfreegeoip.org 2->94 96 api.telegram.org 2->96 98 2 other IPs or domains 2->98 108 Suricata IDS alerts for network traffic 2->108 110 Found malware configuration 2->110 112 Malicious sample detected (through community Yara rule) 2->112 118 13 other signatures 2->118 9 cmd.exe 1 2->9         started        12 cmd.exe 2->12         started        14 cmd.exe 1 2->14         started        16 11 other processes 2->16 signatures3 114 Tries to detect the country of the analysis system (by using the IP) 94->114 116 Uses the Telegram API (likely for C&C communication) 96->116 process4 signatures5 122 Suspicious powershell command line found 9->122 124 Bypasses PowerShell execution policy 9->124 18 cmd.exe 1 9->18         started        20 conhost.exe 9->20         started        22 cmd.exe 12->22         started        24 conhost.exe 12->24         started        26 cmd.exe 14->26         started        28 conhost.exe 14->28         started        30 cmd.exe 1 16->30         started        32 cmd.exe 1 16->32         started        34 20 other processes 16->34 process6 process7 36 cmd.exe 3 18->36         started        39 cmd.exe 22->39         started        41 cmd.exe 26->41         started        43 cmd.exe 1 30->43         started        45 cmd.exe 1 32->45         started        47 cmd.exe 1 34->47         started        49 cmd.exe 1 34->49         started        51 cmd.exe 1 34->51         started        53 6 other processes 34->53 signatures8 120 Suspicious powershell command line found 36->120 55 2 other processes 36->55 60 2 other processes 39->60 62 2 other processes 41->62 64 2 other processes 43->64 66 2 other processes 45->66 68 2 other processes 47->68 70 2 other processes 49->70 72 2 other processes 51->72 74 12 other processes 53->74 process9 dnsIp10 100 api.telegram.org 149.154.167.220, 443, 49698, 49713 TELEGRAMRU United Kingdom 55->100 102 checkip.dyndns.com 193.122.6.168, 49691, 49695, 49696 ORACLE-BMC-31898US United States 55->102 104 reallyfreegeoip.org 172.67.177.134, 443, 49693, 49694 CLOUDFLARENETUS United States 55->104 76 C:\Users\user\AppData\Roaming\...\0957.bat, ASCII 55->76 dropped 126 Drops script or batch files to the startup folder 55->126 128 Found suspicious powershell code related to unpacking or dynamic code loading 55->128 130 Loading BitLocker PowerShell Module 55->130 78 C:\Users\user\AppData\Roaming\...\33fc.bat, ASCII 60->78 dropped 132 Tries to harvest and steal browser information (history, passwords, etc) 60->132 106 104.21.67.152, 443, 49769, 49771 CLOUDFLARENETUS United States 62->106 80 C:\Users\user\AppData\Roaming\...\1a20.bat, ASCII 62->80 dropped 82 C:\Users\user\AppData\Roaming\...\324b.bat, ASCII 64->82 dropped 84 C:\Users\user\AppData\Roaming\...\d2fe.bat, ASCII 66->84 dropped 86 C:\Users\user\AppData\Roaming\...\87d9.bat, ASCII 68->86 dropped 88 C:\Users\user\AppData\Roaming\...\cc95.bat, ASCII 70->88 dropped 90 C:\Users\user\AppData\Roaming\...\ba31.bat, ASCII 72->90 dropped 92 5 other malicious files 74->92 dropped 134 Tries to steal Mail credentials (via file / registry access) 74->134 file11 signatures12
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045/
Verdict:
Malicious
Threat:
Trojan-Spy.MSIL.SnakeLogger
Link:
https://tip.neiki.dev/file/21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehxqiw6a6mlvabyo4aq3pz4b4o4dhvnqq6lvcltensyqxx3aebcq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection execution keylogger stealer
Link:
https://tria.ge/reports/251104-vnd6lsvmaw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Looks up external IP address via web service
Drops startup file
Badlisted process makes network request
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8339120164:AAESuTDCePEPy5CYFLQQ1I3TaczfB2MoJhU/sendMessage?chat_id=744079942
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments