MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 17

Intelligence 17 IOCs YARA 22 File information Comments

SHA256 hash:	5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b
SHA3-384 hash:	740000a33c4619e8f5506a7ede405baae7ef32443f99734cd95be51f4ef72e375cab88d568515a0149c61ef6f1f6df03
SHA1 hash:	f8de6e3efe2b74f8b2e93aba5fc2cdbcf20fd0eb
MD5 hash:	3d0d5452aed53331c9a7a078401d2cff
humanhash:	lithium-summer-magnesium-coffee
File name:	H999876545678900098877654.bat
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	1'048'576 bytes
First seen:	2026-02-18 09:40:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1895460fffad9475fda0c84755ecfee1 (388 x Formbook, 119 x AgentTesla, 58 x a310Logger)
ssdeep	24576:95EmXFtKaL4/oFe5T9yyXYfP1ijXda6gu48hG:9PVt/LZeJbInQRa6
Threatray	3'343 similar samples on MalwareBazaar
TLSH	T1C625AE027391D062FFAB92334B5AF6115BBC79260123E62F13981D79BE701B1563E7A3
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	lowmal3
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt

Details

AutoIt

extracted scripts and files

Link:

https://research.acce.ciphertechsolutions.com/results/8a0a1143-1465-4d83-a781-920baefdb6bb/

Malware family:

n/a

ID:

File name:

H999876545678900098877654.bat.exe

Verdict:

Malicious activity

Analysis date:

2026-02-18 10:07:30 UTC

Tags:

auto-startup evasion snake keylogger stealer

Link:

https://app.any.run/tasks/dd000bd9-96ed-40ae-a836-052b8276281b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/53695/

Detection(s):

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699589452d369b1ab284fd88

Tags:

autorun autoit emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint formbook keylogger masquerade microsoft_visual_cc packed snakekeylogger snakestealer unsafe

Link:

https://www.filescan.io/uploads/6995893e97feb4afd649a22e/reports/ecf1de5d-37f8-4b26-8d47-c8be47f1bf65/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b

Verdict:

Malicious

File Type:

exe x32

Detections:

PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Stealer.fpsi HEUR:Trojan.Script.Strab.gen Trojan-Spy.Stealer.FTP.C&C Trojan-Spy.Noon.TCP.C&C Trojan.Win32.Zenpak.sb Trojan.Win32.Strab.sb Trojan.Win32.Auzenpak.sb

Link:

https://opentip.kaspersky.com/5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/94ad4524-6d21-4eae-904c-7618b22b0c60

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1871041

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Found API chain indicative of sandbox detection

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b/

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b

Threat name:

Win32.Trojan.Znyonm

Status:

Malicious

First seen:

2026-02-17 17:07:09 UTC

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=knzp5mtbksxyztsufrkjfavss3euzsh2zd3n7vsgmlaq7acqkzfq._file

Verdict:

malicious

Label(s):

404keylogger

SnakeKeylogger

60935340a8e15bd11c18985a23267dbe3f2576de3cb4d0cb118f8815e45746e3

SnakeKeylogger

624fe4205bb4581a794e454cdcb181f3d5affd7ee3e452db13c0773dda65ba6a

SnakeKeylogger

6b36a1195cc6a6290c94d9afd1b879476cd92084c7133c8c96459bf8e0e15aeb

SnakeKeylogger

7cd098db07ec6508434e9ec6591a37d706c4a976f4472f3740ff4acb5570ad7b

SnakeKeylogger

91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2

SnakeKeylogger

+ 3'333 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/260218-lnxhhsft2h/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Drops startup file

Executes dropped EXE

Unpacked files

SH256 hash:

5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b

MD5 hash:

3d0d5452aed53331c9a7a078401d2cff

SHA1 hash:

f8de6e3efe2b74f8b2e93aba5fc2cdbcf20fd0eb

Link:

https://www.unpac.me/results/029f1510-3eb4-43c7-a197-43df24b7f18d/

SH256 hash:

366afad132e168747e82f4aec0e8144cc92bbfbdb988b55d8a8e1a985092b76b

MD5 hash:

233ba091cc5c7b102991d67ac031479b

SHA1 hash:

141943aa769c02f8c1465adae12f352b7edc3cad

Detections:

win_404keylogger_g1

snake_keylogger

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

MALWARE_Win_SnakeKeylogger

Link:

https://www.unpac.me/results/029f1510-3eb4-43c7-a197-43df24b7f18d/

Parent samples :

dce7d8b9beeb107ab7520818cbba375962e1c6e8ace6020d1a344446498260ac
366afad132e168747e82f4aec0e8144cc92bbfbdb988b55d8a8e1a985092b76b
58cc97c8ec91ff5751fefc5eb22620f80c05b1fc81b7447d8475c67b31b4e4d2
d49b14dc92b8193db3e087bc2ed25f155c195f8f47774da85bf84a45716a473e
8f1be325faa69592642419a3ce86343a7b484853d0a1b27bd769f8435be85381
e43f4f5010e9eba084c27804f7c9bf915f43fe429746474e0d3b038230623f4c
9cada975130c991b22ff4167678d8bb2cc43a6f7e97a3bc778c7778a4796d619
72b87fdba57360a95d56cf65e93e0421c7ddae90ef6c9235d9756e9f78ce521d
3b82841f90c2399ad32af068c7461b1b62039ddcb2f4c597d25c596b37e48f8b
5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5372feb26154/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

exe 5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/53695/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample