MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449
SHA3-384 hash: 328a4895b395deb25c5ba676279375d169a92a19dd31265b3eea506c3def0d056f162540d154ae58407a409950f26842
SHA1 hash: bbb53c818aac9c21e5bc44ea0e27c3d6b4268746
MD5 hash: 603c88c1b5434d4762e5139784555075
humanhash: uniform-indigo-nuts-minnesota
File name:LATEST SOA FOR SETTLEMENT AS AT 30.06.2025.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'246'208 bytes
First seen:2025-07-07 07:26:10 UTC
Last seen:2025-07-07 17:18:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:UhGtbJXeCtKuRzdhE/Fv6Kvkr4zxKk8huWNORNWaRGSuKYSGa:UWXeCtHRxhENybmsk8VNmkaUSuKsa
Threatray 2'449 similar samples on MalwareBazaar
TLSH T1E1459B4272A5E86AC2768EF1CA21D6F383716E07E615C28B0CE57DCBF5F1F020991A57
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon e9f0d2d2b6b2b28e (4 x SnakeKeylogger, 2 x XWorm, 2 x NanoCore)
Reporter threatcat_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
36
Origin country :
CH CH
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12611/
Detection(s):
SecuriteInfo.com.BackDoor.AgentTeslaNET.27.10706.19602.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686b769c900df8e7f8681a7b
Tags:
backdoor spawn shell spam
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap obfuscated obfuscated packed packed packed reconnaissance roboski stego vbnet
Link:
https://www.filescan.io/uploads/686b769c9db85bde254e51d5/reports/8e35881e-a08c-41e6-8136-7e4804b89542/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cb9427dc-39f4-4273-8a00-f763f08d047f
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.13 Win 32 Exe x86
Link:
https://app.malva.re/file/603c88c1b5434d4762e5139784555075
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449/
Threat name:
ByteCode-MSIL.Trojan.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2025-07-07 04:52:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
79
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e6ss4of32dxpnipk73hgbeh5cjkdxex5wh4qtyilnqnmf4mycreq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
09dcb03bd67ebe186aa8874c549c4e9c62f10fd0ae483b5bf6dc89e2003ebb71
SnakeKeylogger
0f8f4d5651684cb127cb4f921afda71d548b8a75c5976c8b0219586e4dc024d3
SnakeKeylogger
4350dbe482fb5195748203ebc618d6b2f88218b02e4183e203dedebe7e0e94ef
SnakeKeylogger
b87da989bc58c277f819b39884a1a5097c6e55cc522cd482f1db530f10c38ed2
SnakeKeylogger
error
SnakeKeylogger
f5c2ca5c0224f07b3379faeb4d38d468e3266a939731a540700265568c5ee5a6
SnakeKeylogger
+ 2'439 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger persistence spyware stealer
Link:
https://tria.ge/reports/250707-h9nkysam5x/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6e5429a7-9c60-4712-99f2-b2fa00b4f3c4
Unpacked files
SH256 hash:
27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449
MD5 hash:
603c88c1b5434d4762e5139784555075
SHA1 hash:
bbb53c818aac9c21e5bc44ea0e27c3d6b4268746
Link:
https://www.unpac.me/results/2b14a104-577f-4298-a503-ce3e592cfc81/
SH256 hash:
c7dfad992b83f5094d6f1285cf82a260488bc0560ac27ece13cae38acd8a7344
MD5 hash:
824e48075f52cecc53df02299f1caa33
SHA1 hash:
1f82c9b6d47c40c4c7531f9e7f76879aca44dc73
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/2b14a104-577f-4298-a503-ce3e592cfc81/
SH256 hash:
98b0a944fca4c8e57707a52f4eaf31413cf2466907d90553a967643c6853dc18
MD5 hash:
68748c4963c155773ed0f371e5835844
SHA1 hash:
25a5bdd6fb66c300d64a4963a710d2ef8267b218
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/2b14a104-577f-4298-a503-ce3e592cfc81/
SH256 hash:
6b3803d57b5033582d424c2c48ca7c535c2c927a12d56269a413cb61c9c569c0
MD5 hash:
8b2d87ec0d6097cf4cbd324745a2befb
SHA1 hash:
7968b1b4a8053b011dff164c9b6d5862f419f7a2
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/2b14a104-577f-4298-a503-ce3e592cfc81/
Parent samples :
e3677234145c31485431049c53102af6997abc5f82eb3a8a94510d6d2a308f6e
27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449
b1f70f9487ea2c45aa51bf83894ff40e7a8ed522ef2575a1ec1663f0374fa14b
0f62a0bd2f5e4686de5392a0025e45d5b3d222eca4380d63f40010ef671a931a
09dcb03bd67ebe186aa8874c549c4e9c62f10fd0ae483b5bf6dc89e2003ebb71
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 27a52e38bbd0eef6a1eafece6090fd12543b92fdb1f909e10b6c1ac2f1981449

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12611/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments