MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 19


Intelligence 19 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3
SHA3-384 hash: 0bf625b4e680929afd63b26d2f58cc51a7ef19df16309cf0e30d83d0fd0b02a767846498b3f2ae346845dc71fb20e123
SHA1 hash: 74b0658c5b7b85bcae31d4090a6b64893b98dada
MD5 hash: e1911695e0efb5c0d2fef3bbbe79be44
humanhash: kentucky-montana-illinois-low
File name:NEW SHIPMENT INFORMATION.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:525'320 bytes
First seen:2025-12-02 08:47:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:sFMIU4iOtmjqb+qdVyZBil/tfqPFAtS4gkR:EdtxbfdcBstSNwSW
Threatray 62 similar samples on MalwareBazaar
TLSH T107B412A81229DA03EDA167F215B1E338E7B15F6EA522CA2787DECDFFB4417544840393
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c370912e-a0b7-411e-86b2-721d960fd61c/
Malware family:
n/a
ID:
1
File name:
NEW SHIPMENT INFORMATION.exe
Verdict:
Malicious activity
Analysis date:
2025-12-02 08:56:22 UTC
Tags:
snake keylogger evasion auto-sch-xml stealer
Link:
https://app.any.run/tasks/0deffd1f-3f23-4f9e-b538-5f1277307e19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42131/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692ea7fa16e6db515e45e62a
Tags:
injection shell virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expired-cert invalid-signature masquerade packed signed snakekeylogger vbnet
Link:
https://www.filescan.io/uploads/692ea816b3f6e5a2384b738e/reports/aebf1ba4-acb9-4926-8d64-525b67604f64/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-27T00:25:00Z UTC
Last seen:
2025-12-04T03:42:00Z UTC
Hits:
~1000
Detections:
Trojan-Spy.MSIL.SnakeLogger.sb Trojan.Win32.Agent.sb Trojan.Crypt.TCP.ServerRequest Trojan.MSIL.Taskun.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-Spy.MSIL.Noon.gen HEUR:Trojan-Spy.MSIL.Agent.sb HEUR:Trojan.MSIL.Taskun.sb VHO:Backdoor.Win32.Agent.gen Trojan-Spy.Agent.SMTP.C&C PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4f852176-3ffa-4331-92f4-9b5bf5c07c74
Score:
82%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.15 Win 32 Exe x86
Link:
https://app.malva.re/file/e1911695e0efb5c0d2fef3bbbe79be44
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-11-27 03:22:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=maqdy2xznbqzmwqit2zmtktq77fbuxp64nndnhtxvu7rpclkrtrq._file
Verdict:
malicious
Label(s):
404keylogger
Create hunting rule
Similar samples:
60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3
SnakeKeylogger
68358632af8885e3e550eb075c1bc1b2f38e2366fc8e2c19c8fb065865b174c3
SnakeKeylogger
707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
SnakeKeylogger
e11a0dcca950c7f8db943cd71e152257264d9cdfdb0a8ddf23b5e9ebe07daa4f
SnakeKeylogger
error
SnakeKeylogger
+ 52 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery execution keylogger persistence spyware stealer
Link:
https://tria.ge/reports/251202-kqp1sazkav/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/c3039762-b204-4c56-90d1-08c74d8dff1f
Unpacked files
SH256 hash:
60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3
MD5 hash:
e1911695e0efb5c0d2fef3bbbe79be44
SHA1 hash:
74b0658c5b7b85bcae31d4090a6b64893b98dada
Link:
https://www.unpac.me/results/4bea9558-b92b-469a-b8ce-df5b281dd696/
SH256 hash:
6279a0c236b75a2250c898f50d5c0ff542bbcfeeb3f003a12dc9716b8fc10c10
MD5 hash:
9f41c21d3ffaf7f5af4286e6c17fc1fd
SHA1 hash:
07a945acae4953efa10848aa29a47e343577db72
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/4bea9558-b92b-469a-b8ce-df5b281dd696/
SH256 hash:
c3e4867ae04680256a60469acb9857aeb6fde66e4fd4e5d417ac2d494bf70076
MD5 hash:
32ec352cb77179c637dcd9ab3434e4bb
SHA1 hash:
22350403f0f3fa968af12bccbe2b2c9854e52205
Link:
https://www.unpac.me/results/4bea9558-b92b-469a-b8ce-df5b281dd696/
SH256 hash:
77cc5e512fb208b3709a43538a3a24cbcfd05aafc973d3aff8c904fdadbe7c6c
MD5 hash:
0cd8ef984d1560e6222f1decf12aa33e
SHA1 hash:
462f86f1545d155074c7654e081ed65e811da1f9
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/4bea9558-b92b-469a-b8ce-df5b281dd696/
Parent samples :
60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3
e5ad5fef24f10971813d5df1009010467f59a46e7934cb188709e4e9b973c3c4
4de3da2145094b2d623f289bb59e0315edaa2a4820603e1b0384d96da159484c
c9aa4d63ebfcc0345c125489766dd245a348a3f2c0ce15420a8103053237ef1a
36d699808361bcf77a1147c09dc4df6319b7bbf670814ab1f882bc2668fc11c0
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/60203c6af968/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/42131/

Comments