MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 18


Intelligence 18 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
SHA3-384 hash: 7b9fa1fb5e59eb88c303ba2257cb12a71cbb7eef6de03871184124cc8238559495e9b02dfefb197ae2522e528b8fec0a
SHA1 hash: a7c5dc534f6732f3e5a753f689ef22073f1eef36
MD5 hash: b041ba4ce8dd12c9c1bbe5ca4e19f789
humanhash: september-vermont-missouri-jersey
File name:5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:591'872 bytes
First seen:2025-11-06 10:31:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:cj7B2MWiel2NNCPg+pqhISBSBz15JbWbEjhWqbdvnJ5g:cj7B2M9Pu3XVhWqbFg
Threatray 3'790 similar samples on MalwareBazaar
TLSH T18CC40198360AD91BC66197704570F3B903B96EE8E111C392BFE83E9F78B9F105D84683
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341.exe
Verdict:
Malicious activity
Analysis date:
2025-11-06 10:48:20 UTC
Tags:
snake keylogger evasion
Link:
https://app.any.run/tasks/dec163d7-d861-4362-a071-81fc8f8bc983

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/35759/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c7950ea0f3e915c238053
Tags:
shell virus sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Creating a window
Restart of the analyzed sample
Running batch commands
Creating a process with a hidden window
Launching a process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-14T02:56:00Z UTC
Last seen:
2025-11-06T07:08:00Z UTC
Hits:
~100
Detections:
Trojan-Spy.MSIL.SnakeLogger.sb Trojan-PSW.Win32.Stealer.sb Trojan-Dropper.Win32.Injector.sb Trojan.MSIL.Inject.sb HEUR:Trojan-Spy.MSIL.SnakeLogger.gen HEUR:Trojan-Spy.MSIL.Agent.sb HEUR:Trojan.MSIL.Agent.gen Trojan.Crypt.TCP.ServerRequest PDM:Trojan.Win32.Generic Trojan.MSIL.Taskun.sb Trojan.MSIL.Crypt.sb Trojan-Spy.Agent.SMTP.C&C
Link:
https://opentip.kaspersky.com/5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d6acbc7-d967-4e2f-91cd-faa197f26f61
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86
Link:
https://app.malva.re/file/b041ba4ce8dd12c9c1bbe5ca4e19f789
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
Threat name:
Win32.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 09:12:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
29 of 36 (80.56%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lnixrdfbww5jd7lpcigiezhknssk4ro3hxhja6pxihkosdl52naq._file
Verdict:
malicious
Label(s):
404keylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
1fa9224d9441a15cc5f408c3d6ff4bb0bed752010ad3be065dec4c2fa64871a5
SnakeKeylogger
2ed366c595c98fbfe00e692f6d7e06dd237bc2fce08070b610e220083bdb1fe4
SnakeKeylogger
324fcd15e9d6f1b0991ad5943a3178031c608d872cb810eeef48f11295490d6f
SnakeKeylogger
626a21b142572a7729f9ee6746af1a1b21378e2f2457f8bfce9bdbe7d1fbe136
SnakeKeylogger
6e13018ddc2317c56ed048650de037f810b84a91deaa25406921ef4b63c7bcd7
SnakeKeylogger
73cc07e806fc2c6d0beef8c20b20c62a647887e81d3b4306d647416aceb0eccd
SnakeKeylogger
faff33f1bff0dfaf0de6e96c4094314774f3cdaf273d51cd8a4956e0d207390e
SnakeKeylogger
fdd36a586f4979bb696ae7863c45e7332a6e318ef3a6189e1adec270fa698bb6
SnakeKeylogger
+ 3'780 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger discovery keylogger stealer
Link:
https://tria.ge/reports/251106-mkn8eavpap/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/707d2cda-3069-4a69-9aa5-e40af9026f99
Unpacked files
SH256 hash:
5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
MD5 hash:
b041ba4ce8dd12c9c1bbe5ca4e19f789
SHA1 hash:
a7c5dc534f6732f3e5a753f689ef22073f1eef36
Link:
https://www.unpac.me/results/11dd4c3a-e32e-42bc-b92d-c67201de2513/
SH256 hash:
a3ed24a4eb91c11e9e2af34ea127fb9e68dffe6ceda8612751f7434bae4bb2ae
MD5 hash:
02167a951af6641d46d7332934d81a34
SHA1 hash:
23662971e7b6a4861ced789d87760872a2b382e0
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/11dd4c3a-e32e-42bc-b92d-c67201de2513/
SH256 hash:
b794ed0c0c7d4499d0a2ffff67eb5b92dba83f4be7964591e9edad2755176511
MD5 hash:
2a576318d07470206dd7c45f7d896078
SHA1 hash:
3096b2a5ccd98583949a9f57842d5547b50bbc29
Link:
https://www.unpac.me/results/11dd4c3a-e32e-42bc-b92d-c67201de2513/
SH256 hash:
f9eda741e36de984f5764c76429ada284101b74abba47b708ac175c49f8227fe
MD5 hash:
48e1fdaf7662517c4e0f968966d4d7b0
SHA1 hash:
6320e1973e714027f3d4280c125ff36f51848f81
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/11dd4c3a-e32e-42bc-b92d-c67201de2513/
Parent samples :
2ed366c595c98fbfe00e692f6d7e06dd237bc2fce08070b610e220083bdb1fe4
f9eda741e36de984f5764c76429ada284101b74abba47b708ac175c49f8227fe
b234827824cb6864880f9bcf498b15a4a15511e541906347af53f0cd5ed60290
adbd8b904ab4bea6ff62fa51f68c11a1d1593fca88c8f556510f6a2764d98490
91be01581d30136fc1d54926fb6fee17beb10959dae4ff07c9808c0244cce25c
8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
74bfc0967b1636ed58fbfc95523775dbef1e084910676b1e13a775095fec013e
626a21b142572a7729f9ee6746af1a1b21378e2f2457f8bfce9bdbe7d1fbe136
4255224f9842c7cb47d5d5d488d2f45674ac540f2b4652618dd2153acd3cd151
27af0f60f3069416ee2be26ee18589448518135832e18ae26e867a95d22d8065
324fcd15e9d6f1b0991ad5943a3178031c608d872cb810eeef48f11295490d6f
5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5b51788ca1b5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35759/

Comments