MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Intelligence 17 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb
SHA3-384 hash: 8a6124802224acbdec5426d1571a10f99c76f7ea785ae952388162b5eee9b6c01e59e3db612dbc4163393e683c206216
SHA1 hash: b060a1870bb31bdd5824a5b04169faa92116e4f2
MD5 hash: 5293e67d5def2be60ba9291f7229c619
humanhash: alanine-chicken-crazy-jig
File name:ORDER 121120.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:641'024 bytes
First seen:2025-05-23 13:22:47 UTC
Last seen:2025-06-22 11:51:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:6kqe5/miSLIPmzucRk84SQ4TuKGfM9u29nhSMwGWczmRiKZ88dE7yTmE7hlZrV:6kqm3jCuQkUQuzeOhNwGWczu/866y
TLSH T1BCD4F19C3005B84FC44786B489A0EEB46778AC9E5703C743DAD72DDBBD2D6C79A091E2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 0040404971716800 (10 x Formbook, 9 x VIPKeylogger, 9 x SnakeKeylogger)
Reporter James_inthe_box
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
463
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ORDER 121120.exe
Verdict:
Malicious activity
Analysis date:
2025-05-23 13:29:13 UTC
Tags:
netreactor evasion snake keylogger stealer smtp
Link:
https://app.any.run/tasks/31c1167d-015e-482f-9883-8d84318093ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=683079ca4912a6b9dd4c6bc3
Tags:
virus micro spam msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a file
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/683076c6171e01f9592b7aa0/reports/e2208be4-fd98-43b5-b091-d0bd972724f5/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a939aab-3dea-40e9-88c0-8a6030238cae
Result
Threat name:
PureLog Stealer, Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1697767
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Found malware configuration
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Uses threadpools to delay analysis
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1697767 Sample: ORDER 121120.exe Startdate: 23/05/2025 Architecture: WINDOWS Score: 100 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 10 other signatures 2->25 6 ORDER 121120.exe 3 2->6         started        process3 file4 17 C:\Users\user\...\ORDER 121120.exe.log, ASCII 6->17 dropped 9 vbc.exe 6->9         started        11 vbc.exe 6->11         started        13 vbc.exe 6->13         started        15 2 other processes 6->15 process5
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2025-05-22 03:42:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e6tv4rdpfuo4prdnnoags363xh5t64ggetu743fblrix5fbv4l5q._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
404keylogger
Create hunting rule
Similar samples:
error
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery keylogger stealer
Link:
https://tria.ge/reports/250523-qmrm4adr7y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Uses the VBS compiler for execution
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f68f8ae8-9426-4cd6-93bd-8e07000ad9f0
Unpacked files
SH256 hash:
27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb
MD5 hash:
5293e67d5def2be60ba9291f7229c619
SHA1 hash:
b060a1870bb31bdd5824a5b04169faa92116e4f2
Link:
https://www.unpac.me/results/d8497336-50bd-44a0-abba-6ea7463e08b0/
SH256 hash:
0656f59c9e7cfa07d64cf4cd7d85ebd9b4399893cc853f3d1d37cca622d1f815
MD5 hash:
e4a8fe009b340647108a98105600f476
SHA1 hash:
03193855202feecd4bc542876855e706a243f13b
Link:
https://www.unpac.me/results/d8497336-50bd-44a0-abba-6ea7463e08b0/
SH256 hash:
5afe92bbe5c6fa4e9ab9322c436a7168aea07dbe0ce3f27cf174136b4f143f37
MD5 hash:
d5b2a125a0609f3a157c43bfdaaa4d05
SHA1 hash:
432407ed884600f8c444017b6ae72153185d35a6
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d8497336-50bd-44a0-abba-6ea7463e08b0/
SH256 hash:
d2722609b4680da309d18cc490011b8eb8fcac8e09790c5092915503bd7af376
MD5 hash:
d770c0b309e1d8b1bc73fcdd9759ff7d
SHA1 hash:
58955464f44e6746e10f13f07c1a1ce17c931ad9
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/d8497336-50bd-44a0-abba-6ea7463e08b0/
Parent samples :
27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb
f189b4984051d8ad1499703a8a3719bdd0f4aae921416171443758e321a52246
52843d737e9578b50ab5ad397368afd80eb72bd26905ced2742ca5d56d348b84
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/27a75e446f2d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 27a75e446f2d1dc7c46d6b80696fdbb9fb3f70c624e9fe6ca15c517e9435e2fb

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments