MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92
SHA3-384 hash: 17560ed6433323c5457105dcd19f3899f4096e4ea9ed3ffadea516271f8c6303793641acde6c2238fd5abe88bc2458b2
SHA1 hash: ed01cb98754c0a4d93ce03d4c71ac21d50e4a202
MD5 hash: 28b8e3509ee3b4e6e4c91c70bbff9b68
humanhash: virginia-pluto-beer-zebra
File name:SOA Balance Payment.zip.001
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:548'168 bytes
First seen:2025-06-17 09:20:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hNTJOzr7W2Xo2awEtVrQn0So+F4hT1t4xQ2W0D/aNi2xPo2DM/FvmNO:h6zWcaHrc4bt65iw2lo24/FeNO
TLSH T13CC423457963C4B608E05BAB92B8CDBF8291B21D6E1DEE21D634C9F26217CCD5172CEC
Magika zip
Reporter cocaman
Tags:001 payment SnakeKeylogger zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""KMGHAN - TRANG ACCT" <acct8han@kmg.vn>" (likely spoofed)
Received: "from kmg.vn (unknown [141.98.10.87]) "
Date: "29 May 2025 09:23:45 +0200"
Subject: "RE: SOA AS AT MAY 25 - KHAI MINH USD 49,534.00"
Attachment: "SOA Balance Payment.zip.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SOA Balance Payment.exe
File size:744'968 bytes
SHA256 hash: b7da8e1da29ef0f633a90ed8da677147faa0785dd2c68638d0c2c441f31d0fcd
MD5 hash: 237852fa369bfecc7ccb646fd3460b42
MIME type:application/x-dosexec
Signature SnakeKeylogger
Vendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68513383f08ffc92600dc810
Tags:
virus micro msil
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expired-cert invalid-signature masquerade mikey obfuscated packed packed packer_detected signed vbnet
Link:
https://www.filescan.io/uploads/6851337858764b44c67b14e5/reports/cce3c9d0-d8f4-49a3-8162-68b522c1dc50/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2025-05-29 07:01:24 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fzle5ezkgudeyttlxg3vxoyapjacxscuvpxavk5byhbpvqr4zkja._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger discovery execution keylogger stealer
Link:
https://tria.ge/reports/250617-mmgaksap8t/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 2e564e932a35064c4e6bb9b75bbb007a402bc854abee0aaba1c1c2fac23cca92

(this sample)

SnakeKeylogger

Executable exe b7da8e1da29ef0f633a90ed8da677147faa0785dd2c68638d0c2c441f31d0fcd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7da8e1da29ef0f633a90ed8da677147faa0785dd2c68638d0c2c441f31d0fcd
  
Dropping
MD5 237852fa369bfecc7ccb646fd3460b42

Comments