MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
SHA3-384 hash: 05c7df6e860385b319a5bb09e85703bafa81facac45f162df8d3a307e5d6c047e21c16c88374b7bed0cf6e30289849b9
SHA1 hash: 024177713582f0d673ae649a46d93a39b3b87055
MD5 hash: 94d673f92eb01990e9b19cbe354850f7
humanhash: papa-wisconsin-tango-oranges
File name:2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'022'976 bytes
First seen:2025-08-12 15:03:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:ztb20pkaCqT5TBWgNQ7aGFzINUDbMN6A:wVg5tQ7aGFdk5
Threatray 2'848 similar samples on MalwareBazaar
TLSH T18725BF1373DE8361C3B25273BA26B741AE7F782506A1F96B2FD8093DE920161521E773
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
Verdict:
Malicious activity
Analysis date:
2025-08-13 01:13:07 UTC
Tags:
evasion snake keylogger telegram stealer exfiltration smtp
Link:
https://app.any.run/tasks/aad7988d-bc07-4308-89a6-f56644a53bea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/20930/
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b5cb2fca70bd90e8f21c1
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script evasive fingerprint fingerprint keylogger lolbin microsoft_visual_cc packed reg threat
Link:
https://www.filescan.io/uploads/689b7b149ef4d2ff7cf8dffe/reports/a597cbbb-cf85-40d6-a0bc-a39e15159e46/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5baf7679-9cc3-45e8-b86a-cc585e820868
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
Gathering data
Gathering data
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-07-31 21:05:12 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fmvoszwtjjt5wbxwkofe7halbemjsvdl5k54j4ulxmr6lxt3truq._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
unc_loader_036
Create hunting rule
vipkeylogger
Create hunting rule
Similar samples:
0331c939a6f02aed4ce0932c2f6f28a5213ddc39f493e9f166b08124b939d7ee
SnakeKeylogger
458ac52092b96841fe90abb19a244969102a900f7c6b5199040bde55fc8b0317
SnakeKeylogger
6d32402a6251d846ed8029bacce4139245eb1606c3a2686d49f3bbfe29c5244a
SnakeKeylogger
6dfd8a72f4d4d7ed38ac75342f99d74a1a96441f886b51c54d41760761c47e92
SnakeKeylogger
a940014a730129f95371c84c982bcbf378586e7afd6eb2f3d0acaf0d15a8ded4
SnakeKeylogger
af6e3afe54776fbfcfd18d707576ea0ae9504da1d53f7af1ae41fd71408816d4
SnakeKeylogger
c53170393e7825648709b042f54ff764a4228f38b31ecf29b7e7d971b4e42b56
SnakeKeylogger
+ 2'838 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger stealer
Link:
https://tria.ge/reports/250812-v2bmmstvds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
VIPKeylogger
Vipkeylogger family
Verdict:
Suspicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/24971b5c-9332-4323-968c-23cda2c3d07f
Unpacked files
SH256 hash:
2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
MD5 hash:
94d673f92eb01990e9b19cbe354850f7
SHA1 hash:
024177713582f0d673ae649a46d93a39b3b87055
Link:
https://www.unpac.me/results/e6edd883-ffb3-4474-9a8a-6c74dc83f7b1/
SH256 hash:
35e7225fea67de12a03b13bd25124d173d66d882f5d68b59eb8455c9f16e546a
MD5 hash:
bdd7858efac937a99b1acc590d63ef5d
SHA1 hash:
b7411666cfee1439abba8b46959031a70203f344
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/e6edd883-ffb3-4474-9a8a-6c74dc83f7b1/
Parent samples :
8b11fcca89381e3f89964db156074fb4d4a00a5b0963010fd9396a2463e84034
f1c4b423031489d5ea36e682f729f981789e020dccca81ea7b2bfceef1ee62cd
5ad3f15faf80e24a6c002f577b2b00b2039eec0d19f848cfcfeea9d494ef83dc
2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69
593b2dd3e7a1806f5f97341c297792834c28f57fb95e33c4528c733a9fed4c73
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b2ae966d34a67db06f6538a4f9c0b091899546beabbc4f28bbb23e5de7b9c69

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20930/

Comments