MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49436e26b0e75e5eaa17147fbb84b2ffc673136184f6476db9842faf0244e875. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	49436e26b0e75e5eaa17147fbb84b2ffc673136184f6476db9842faf0244e875
SHA3-384 hash:	50ae957c259a06fc006ce3fad2fcb35e6719e464f708bfcb2f2df995d3ca783418b47f40e808ee49de0f786596b8c699
SHA1 hash:	d22926a28f426c08a40c89457bc51ace5649af70
MD5 hash:	fc7eee8c0d0ec702f9a1936b0dd0d494
humanhash:	beryllium-one-november-iowa
File name:	Advise details P100186803.tar
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	786'944 bytes
First seen:	2025-07-29 12:28:55 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-tar
ssdeep	12288:l/pOA6+WL4C+43/2BhMl5a52OekZrGi2fmoMzz2IZsJ2FjRBqUldUmc1T29oy:1s4tAlkgVktGi2MzTRBvUmc5x
TLSH	T1B6F4BE7036AE8963C96985F00520E17533B72ECF642AEAE94ED67CDB3CE5BC41B50913
TrID	62.9% (.TAR/GTAR) TAR - Tape ARchive (GNU) (17/3) 37.0% (.TAR) TAR - Tape ARchive (file) (10/3)
Magika	tar
Reporter	cocaman
Tags:	SnakeKeylogger tar

cocaman

Malicious email (T1566.001)
From: "Shaista Iram <compliance@capital-sports.net>" (likely spoofed)
Received: "from 216-131-75-250.atl.as62651.net (216-131-75-250.atl.as62651.net [216.131.75.250]) "
Date: "28 Jul 2025 14:51:39 -0700"
Subject: "URGENT:Pi Advice Note P100186803 from 30.06.2025"
Attachment: "Advise details P100186803.tar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6888be95af3050dc8d3210cc

Tags:

agenttesla kryptik virus msil

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 bitmap lolbin msbuild obfuscated packed packed reconnaissance regsvcs rezer0 roboski schtasks stego telegram vbc vbnet

Link:

https://www.filescan.io/uploads/6888bea3c79df08ef0979b02/reports/770408d0-1451-416b-a472-88d2382c2d90/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/49436e26b0e75e5eaa17147fbb84b2ffc673136184f6476db9842faf0244e875

Score:

99%

Verdict:

Malware

File Type:

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery execution keylogger persistence stealer

Link:

https://tria.ge/reports/250729-qazsyagr71/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

SmartAssembly .NET packer

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Command and Scripting Interpreter: PowerShell

VIPKeylogger

Vipkeylogger family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/49436e26b0e75e5eaa17147fbb84b2ffc673136184f6476db9842faf0244e875

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)