MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
SHA3-384 hash: f419811ba080e4d1026d27c8b7b92cc4fefb2cac3e6cbfe8d84d201cae9f5548bc880b19333b7151769622c77846b1d3
SHA1 hash: 19ace427be22982a1985ca23cfd2fc912054d488
MD5 hash: f349bf1d7f361ac81f9481d610041ef0
humanhash: bulldog-sixteen-blossom-ink
File name:PLATES GASKET SPECIFICATION.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:754'688 bytes
First seen:2025-07-06 21:05:43 UTC
Last seen:2025-07-14 07:24:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:i/5d7Ux3myogefCsy40v35w1Jb6ZWpyUm7NRGSBYRGtz21/+Z:i/b72m3geFioQFUvzGtzk
TLSH T104F4DF1027648B06E57687F64511E13213F85EAE64ADE3096FC1BDDF38BAF806990F27
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter threatcat_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
43
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rl_252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
Verdict:
Malicious activity
Analysis date:
2025-07-06 21:07:45 UTC
Tags:
snake keylogger evasion auto-sch-xml netreactor stealer
Link:
https://app.any.run/tasks/c6cf356d-c098-41a4-88fd-f77edbf50762

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12568/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686ae551900df8e7f867df9f
Tags:
spawn shell virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap obfuscated obfuscated packed packed packed reconnaissance roboski stego vbnet
Link:
https://www.filescan.io/uploads/686ae54dd6e1f26251e430dd/reports/3b907e04-1100-4048-9b83-aa15006b5dd1/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dc4440cc-06d3-4d0e-b07d-f8bb44e7b3af
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
Verdict:
inconclusive
YARA:
9 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.04 Win 32 Exe x86
Link:
https://app.malva.re/file/f349bf1d7f361ac81f9481d610041ef0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496/
Verdict:
Malicious
Threat:
ByteCode-MSIL.Backdoor.FormBook
Link:
https://tip.neiki.dev/file/252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
Threat name:
ByteCode-MSIL.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-07-05 12:47:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eurchrdznup7agcpkso5tsxeucvqpsbjlc5ud6be7g4kvex2ksla._file
Verdict:
malicious
Label(s):
404keylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery execution keylogger persistence spyware stealer
Link:
https://tria.ge/reports/250706-zxw51atvey/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/601b21c4-4bbe-4a14-b6da-da6a1ed22517
Unpacked files
SH256 hash:
252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
MD5 hash:
f349bf1d7f361ac81f9481d610041ef0
SHA1 hash:
19ace427be22982a1985ca23cfd2fc912054d488
Link:
https://www.unpac.me/results/80e0e372-51ab-4954-8e60-e03adc4fdfd8/
SH256 hash:
36200781beb2d56c8705c152246b0fac20f7a2cb13d988eee7de6529b9f1a1f0
MD5 hash:
e5a27de9609950379c07b3ebdc8d9772
SHA1 hash:
7c2fd4dd8bb0b6a9e9d27d5650d344a3bd4e696a
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/80e0e372-51ab-4954-8e60-e03adc4fdfd8/
Parent samples :
368c3f4373be7b2de2adb08b623315e12d69d4d3f174c6a5d5b3e892a85fee51
9128341eadbe23a479073756b46a420ec61725b60d8b7d68f428e997e30fc85f
527faa491b052e081f3f21cc8a1499a895e69184b46fc039b382150f4ee7063e
252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
d4d73e62678d24bb40d098fca92648ccf6c10622ec0925115efb21adfaa740ac
972fe50205f384bf9fd55ca98763d4ced7447b919bb69e376c483b4721a505d3
SH256 hash:
f6877acebb44662c3cd28886cd510cef22be60bf60078ced634c43ed35f43f35
MD5 hash:
e242d05e59e487458b69b0be7c8e3eb9
SHA1 hash:
c1cf7b814722482a83a17738226d6c4297b7dd07
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/80e0e372-51ab-4954-8e60-e03adc4fdfd8/
SH256 hash:
16e297f9c3a8ad4363b62c7456293e27250ff6d2e42c266d10ad706140951ebc
MD5 hash:
b5ef5666649a89c7f53e182578442590
SHA1 hash:
dfb8e0b57d791d651a7f60cdc9e20316e6a1d151
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/80e0e372-51ab-4954-8e60-e03adc4fdfd8/
Parent samples :
24756c0e13f3650f2d0c082d6938a9228eeb5befb6af1b02bd278e07b8488ea4
252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 252223c4796d1ff0184f549dd9cae4a0ab07c82958bb41f824f9b8aa92fa5496

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12568/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments