MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969
SHA3-384 hash: ab1b62517c46d774f0968ce3a8ad87817297d56cd6c461aad1390c3f64073b052517ea749f636a3809c17647b0cc9359
SHA1 hash: 29d32b9bc1abea052bcbcd5e62a46154934f5a5a
MD5 hash: 4b04601fcada5abeee233cb77c5be117
humanhash: don-berlin-failed-undress
File name:2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:665'088 bytes
First seen:2025-07-07 15:00:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:XugTm4wa1/nkJseN3zOASvOdPRy2PHrE6OXFJnm+0wS8pZBFi5R84Z:xJFkJsQPSvOdPouERV5p0r+ZBIr
Threatray 3'633 similar samples on MalwareBazaar
TLSH T13EE4BD943FB5AEC2E86407F14521EAF85379AF9A4C20C39A6DDCBFDB74387442928153
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 344bc4e06968300c (4 x AgentTesla, 4 x Formbook, 2 x SnakeKeylogger)
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
27
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/13163/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686be167c9eb974737677433
Tags:
backdoor virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b4f9fc8-69ec-4bde-a4ff-bc9caed96789
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.02 Win 32 Exe x86
Link:
https://app.malva.re/file/4b04601fcada5abeee233cb77c5be117
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-06-25 02:53:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fudo6z5geufb57unj4qzxgbygkgsu23qnqylug5vot5i6nuerfuq._file
Verdict:
malicious
Label(s):
404keylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
068e05c944faf172cf83584b995dd98b6ad77a42df01e0bda06cec52eebc3074
SnakeKeylogger
7b2118ed1133b43f2521509f4eac9e89b89cdfc389208099cc6e601aaf95c836
SnakeKeylogger
832c9fff9119971e24be408c892db66a20202af2089d4693047b8e785ebc08dc
SnakeKeylogger
b1bd96341b2c06cf1ea7a1a9026222f1a85d8605798be6f7809100b3e0bd11dc
SnakeKeylogger
b37e686fd31a86e8ace7bac6a862b1388241527af590a168c294801cfbecd5b1
SnakeKeylogger
error
SnakeKeylogger
+ 3'623 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/250707-sd48yawwaz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7553756477:AAEJRDCZrF55wgYQ-4cK-cvXQztk-pQTicg/sendMessage?chat_id=7564846096
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/09435cbc-2d52-4c2d-9cb3-a66275dd213d
Unpacked files
SH256 hash:
2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969
MD5 hash:
4b04601fcada5abeee233cb77c5be117
SHA1 hash:
29d32b9bc1abea052bcbcd5e62a46154934f5a5a
Link:
https://www.unpac.me/results/7a1b0574-ae9b-480f-bdc8-0b29fc1c5078/
SH256 hash:
db347d4a372a9862d5bba212f4a160eea023370e90d0de14b85a76ae37ead8ed
MD5 hash:
db899b1b5371b7f5bc2b261aacefe507
SHA1 hash:
4f7cc62e811af3b8c67080073fb4d395d953f41c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/7a1b0574-ae9b-480f-bdc8-0b29fc1c5078/
Parent samples :
93dddc36d04545478110085efaee314f834dc776c39d426cc72ec7ae3d804b1f
ae818fd422d1eba54edfdbb1043f749b9931038157e3db1675d7c17fff3d1169
f532b6d77041027a94bfbc117759218899faad1441e4f60b57197d0a687b9240
0bfb0b841074e05c24408075a90c89647429199cf37b4970a0e17b49e334c857
2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969
8ff46bf774cf4df83894570294999b7f02f67014a4d3280c092f41a049097f4a
SH256 hash:
88d63f84c53ee3cc6fd42c58a983ea4e13078ff73ce38fdb1b48ccd20db8ac0a
MD5 hash:
4f9c3143da9896231e394840d8ac41cd
SHA1 hash:
50e38b4534edca3276b04d33f0a177de19d920f3
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7a1b0574-ae9b-480f-bdc8-0b29fc1c5078/
SH256 hash:
dd1f58bee530c443fb0c6671c3aa03f66cfb8880aec17d109446a30b9e78a585
MD5 hash:
42b1b51565fcb301f1aca46dc0264326
SHA1 hash:
d3f6f8710f0c8c674ac6dcd17c1253d2306f5f80
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/7a1b0574-ae9b-480f-bdc8-0b29fc1c5078/
Parent samples :
5f31ae849162679f3f77a484a2f1915b69e805d3e5c5b3e57b5941885e21d62e
0ccfcbd467b949b1658d188651152bcc945adce590e0e15f39967da1813d5186
3a85ae54aa037e1651b9c67673d6c6f9fd723b92b111431ce0d285fcb99aff17
2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969
98d1ac576a345580e6c3f3bfc39472475d21f5320c443501772ba92166c09dcc
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d06ef67a6250a1efe8d4f219b9838328d2a6b706c30ba1bb574fa8f36848969

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/13163/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments