MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 18

Intelligence 18 IOCs YARA 17 File information Comments

SHA256 hash:	285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff
SHA3-384 hash:	dbe2f9603d753c5786a994de6c13f98f181144802bc2ee8d6726a670aed82f50621db032f8a604c8ad89fbf2f85f24e3
SHA1 hash:	772e55ed9068a089b1a85d47fb4e3995c1efd404
MD5 hash:	f3773bc800704a58ff5ec66ec5f02679
humanhash:	vermont-mars-equal-virginia
File name:	new order.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	696'320 bytes
First seen:	2025-09-10 06:57:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:2BYMq9oL7WUhpOhWgHGIs0WCYTO6Fke7T0gNWQIV5E:2TRL7INN6aexNWN5E
Threatray	3'370 similar samples on MalwareBazaar
TLSH	T19CE40158225AD917D5669FB41E31E3B41F68AE9AF512C203EFDE7EEFB035A801C41342
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	Anonymous
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

new order.exe

Verdict:

Malicious activity

Analysis date:

2025-09-10 07:10:37 UTC

Tags:

evasion snake keylogger telegram stealer

Link:

https://app.any.run/tasks/7b642ac4-0658-4785-8e7a-3be960594197

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/26635/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c1219fb20052598879628f

Tags:

backdoor spawn spam hype

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Connection attempt

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Blocking the Windows Defender launch

Blocking a possibility to launch for the Windows Task Manager (taskmgr)

Stealing user critical data

Forced shutdown of a browser

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 bitmap lolbin masquerade msbuild obfuscated packed packed phishing reconnaissance regsvcs rezer0 roboski schtasks stego telegram vbc

Link:

https://www.filescan.io/uploads/68c12223a1a41633174f73bb/reports/aede6396-8115-4737-b787-535627e2f6e2/overview

Verdict:

Malicious

Labled as:

Genie.8DN.Generic

Link:

https://www.hybrid-analysis.com/sample/285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-09T03:35:00Z UTC

Last seen:

2025-09-09T03:35:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff/results?tab=lookup

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b8fd7785-1ca1-4742-a8e2-2e5d08c53f0f

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2025-09-09 09:56:24 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

29 of 38 (76.32%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fbpspn5jpzgjaif7abvekqzxiayqmmfhlnfpibn3bwukmurs277q._file

Verdict:

malicious

Label(s):

vipkeylogger

unc_loader_037

SnakeKeylogger

2f76a21937582bd59783cab01437d029a6ccd52635e2a3f424831ad7e444e640

SnakeKeylogger

6b734c88958bfe7447e6702844486156daf7a54cbd0a1cf9b7bfef98daadf519

SnakeKeylogger

7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8

SnakeKeylogger

+ 3'360 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection defense_evasion discovery evasion keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250910-hr5rhswyhy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Disables Task Manager via registry modification

Modifies Windows Defender DisableAntiSpyware settings

VIPKeylogger

Vipkeylogger family

Verdict:

Suspicious

Tags:

404Keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/603e7da6-2801-477e-ad71-39a296db4d52

Unpacked files

SH256 hash:

285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff

MD5 hash:

f3773bc800704a58ff5ec66ec5f02679

SHA1 hash:

772e55ed9068a089b1a85d47fb4e3995c1efd404

Link:

https://www.unpac.me/results/6348e6a6-5e3e-4a23-b707-26ebb6707199/

SH256 hash:

12dda0cd3b378fbced3071df357733426bb09e47c31fcc3ba6273650f67895dc

MD5 hash:

773c55854eb467033abb78bc2b667f80

SHA1 hash:

54bfd694185cd257abb4ee6b477dba12b971b9b9

Link:

https://www.unpac.me/results/6348e6a6-5e3e-4a23-b707-26ebb6707199/

SH256 hash:

bb59a73f7732e8a5c1206539986e83ed3fe434cabf36140831e12e7dfd9a1460

MD5 hash:

b313d1633c8c129a0a96dec5c534c8bf

SHA1 hash:

7443225ccb1c2ee2aa7d2254edfd2b6b2b496e0f

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/6348e6a6-5e3e-4a23-b707-26ebb6707199/

SH256 hash:

13cb5381ef79e46b1b4ee48c75b8a1a3768c8462183b316137fc51b0d98002f2

MD5 hash:

7c5f93610721117622f488bd8f476e60

SHA1 hash:

90394696ac147dd9d8d0fa1bcae1c93abf8dcf75

Detections:

win_404keylogger_g1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Link:

https://www.unpac.me/results/6348e6a6-5e3e-4a23-b707-26ebb6707199/

Parent samples :

d41022d91ed5c237cbcb1cfaef080005bf5dae114f06418c873596c6c0149a11
f8591a5b43f62cdd88b1e86812b7360ba8e9b41b2780f8df5f276fd4298f4db8
c2f71c006d57414ecfcc0a9718779ae6f19c63ff7ef6738c4a5aa7c38e28d77e
b43a26bba9392c41659ef71c0ba10b4c00d641646c002a64cbe11d09fc4f5cd9
10f246e9a23f84a9e80787e654d3f5612eaded3b992ccaa7a92a94ce8676e40f
ad188854da20c440975e7bf1bfc218c1917da6d7155c77b8c03fefc148ac1759
4ed89812437a80fce23d4c00bafc70da61f00f23f8c0132863385686c2e8a06d
946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff
67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288

Malware family:

VIPKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/285f27b7a97e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/26635/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample