MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ea465280bd3e97a5ba825d38e6d49bdceb14368b26f17e8432d823a74d57fe9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA 24 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ea465280bd3e97a5ba825d38e6d49bdceb14368b26f17e8432d823a74d57fe9
SHA3-384 hash: 17aa61784d9ae42c6329426071d37e02f3d9f5a0f5856f86589faff1b58cc62732158bae27a45db64c44294c0132cf67
SHA1 hash: 22e9a736f5aa23a7a7f79ad1cc73099172efd675
MD5 hash: 238d5db8e46822010695748ee73b9001
humanhash: yankee-batman-lamp-triple
File name:nQUOTE_REQUEST_EI2025-6001_DOCUMENT.lzh
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:765'726 bytes
First seen:2025-06-02 06:30:07 UTC
Last seen:Never
File type: lzh
MIME type:application/x-lzh-compressed
ssdeep 12288:W7g04sqQIaHEmBbkk81IZLAJeZFV7pVoPBCoOMB6u7ntjoX:WUNPakSl8GtAg5o5ROy+X
TLSH T1E0F4232B3D04529BE400833DBE878858BB856D4564B33FFD6639BC490F32B958E9D4DA
Magika unknown
Reporter FXOLabs
Tags:file-pumped lzh SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
BR BR
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:aquacargokamerun.jpg
File size:163'953 bytes
SHA256 hash: bc82b929d2d82cccb32f3bfb6c3a5b4d12b51f957ef62cd0e477ec8d09b05719
MD5 hash: 5ab671df80e0e00cb5c60221abf5d456
MIME type:image/jpeg
Signature SnakeKeylogger
File name:QUOTE_REQUEST_EI2025-6001_DOCUMENT.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:630'194'176 bytes
SHA256 hash: 6fb54603208633cea84538b077e664ae5b72c72a4454d52cf6491380dbc9b260
MD5 hash: 0430ee6592ba0ddb925474e1c0ed0a27
De-pumped file size:1'038'336 bytes (Vs. original size of 630'194'176 bytes)
De-pumped SHA256 hash: 5f16564812fd6fd62f52d56dc785a300324c12bf6221a02b3e0436016e12b5eb
De-pumped MD5 hash: edcab89500b369a995ecf5ea028cd02b
MIME type:application/x-dosexec
Signature SnakeKeylogger
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.DecompressionBomb.16669.14434.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=683d4725acf88f5815eb16dc
Tags:
malware
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/683d45258fe97b0b5579b4fa/reports/748dc0e0-8fdc-4dc9-8355-2854dbd68b0e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5ea465280bd3e97a5ba825d38e6d49bdceb14368b26f17e8432d823a74d57fe9
Score:
13%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/5ea465280bd3e97a5ba825d38e6d49bdceb14368b26f17e8432d823a74d57fe9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ea465280bd3e97a5ba825d38e6d49bdceb14368b26f17e8432d823a74d57fe9/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-02 04:54:36 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2sgkkal2puxuw5iexjy43kjxxhlcq3iwjxrp2cdfwbdu5gvp7uq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250602-hapzqseq6z/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5ea465280bd3e97a5ba825d38e6d49bdceb14368b26f17e8432d823a74d57fe9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_404keylogger_g1
Create hunting rule
Author:Rony (@r0ny_123)
Rule name:win_rat_generic
Create hunting rule
Author:Reedus0
Description:Rule for detecting generic RAT malware
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

lzh 5ea465280bd3e97a5ba825d38e6d49bdceb14368b26f17e8432d823a74d57fe9

(this sample)

SnakeKeylogger

Executable exe 5f16564812fd6fd62f52d56dc785a300324c12bf6221a02b3e0436016e12b5eb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f16564812fd6fd62f52d56dc785a300324c12bf6221a02b3e0436016e12b5eb
  
Dropping
MD5 edcab89500b369a995ecf5ea028cd02b

Comments