MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 19


Intelligence 19 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
SHA3-384 hash: fcc9adc9741db95e490e33a0b2832c85a42cf4d3302a9e7f6dae1be3f20b4ef60d2532315523697367c6e5aa134eb60c
SHA1 hash: 532ccb67f65658aed7b52bb090cbee9a61b25002
MD5 hash: 7722a6c6a62e793a5800925f63b0ce00
humanhash: paris-maine-quiet-hotel
File name:67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:743'424 bytes
First seen:2025-10-10 06:24:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:2KqOZQ8bFRHabheQhgxBV2J3Awnxb1LZVTO3hBXtgZP4b2BKVz/eT8gkpz:lRQ6vH5QhWBDuxbNZcvtgZP4SBK9G3G
Threatray 3'449 similar samples on MalwareBazaar
TLSH T180F4D0162F9DC9D9D0F2CAF60533D2B01E7C9E64AD52E2328ED53F9BF63E6508902152
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
Verdict:
Malicious activity
Analysis date:
2025-10-09 13:24:04 UTC
Tags:
snake keylogger telegram evasion stealer
Link:
https://app.any.run/tasks/30ba9b3e-c44f-480a-b6ca-301bc2b4030f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31993/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.6490.4170.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e8a6ec23804d0975b66ec9
Tags:
virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Blocking the Windows Defender launch
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Stealing user critical data
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap formbook lolbin msbuild obfuscated packed packed reconnaissance regsvcs rezer0 roboski schtasks snakestealer stego telegram vbc
Link:
https://www.filescan.io/uploads/68e8a71c4f3013c55e4935fc/reports/b883ee7c-9ba3-4c87-bea7-1620d74bcb34/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-11T00:52:00Z UTC
Last seen:
2025-10-10T09:59:00Z UTC
Hits:
~1000
Detections:
Trojan.Win32.Diztakun.sb Trojan.MSIL.Taskun.sb HEUR:Trojan-PSW.MSIL.Agensla.gen PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Injector.gen Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb
Link:
https://opentip.kaspersky.com/67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/865ff4bf-c5e1-40ac-ae01-b9ccf699672f
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.28 Win 32 Exe x86
Link:
https://app.malva.re/file/7722a6c6a62e793a5800925f63b0ce00
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-09-11 03:50:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
28 of 36 (77.78%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6x2uamnwiqnbx4yv5cg7wpep74pscj4xul6rqiacgnb5643ekea._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_037
Create hunting rule
unc_loader_078
Create hunting rule
Similar samples:
2bd14b966dec6792a03cd2925460702e0a83da7d3d4b3461eac8f01c78cc1326
SnakeKeylogger
2f76a21937582bd59783cab01437d029a6ccd52635e2a3f424831ad7e444e640
SnakeKeylogger
6b734c88958bfe7447e6702844486156daf7a54cbd0a1cf9b7bfef98daadf519
SnakeKeylogger
7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8
SnakeKeylogger
+ 3'439 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection defense_evasion discovery evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/251010-g6944s1ly5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Disables Task Manager via registry modification
Modifies Windows Defender DisableAntiSpyware settings
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/5e7550d8-ed9d-4616-b877-bf4b27922e1a
Unpacked files
SH256 hash:
67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
MD5 hash:
7722a6c6a62e793a5800925f63b0ce00
SHA1 hash:
532ccb67f65658aed7b52bb090cbee9a61b25002
Link:
https://www.unpac.me/results/51ce2ca1-975d-498f-910c-337e17bb0396/
SH256 hash:
12dda0cd3b378fbced3071df357733426bb09e47c31fcc3ba6273650f67895dc
MD5 hash:
773c55854eb467033abb78bc2b667f80
SHA1 hash:
54bfd694185cd257abb4ee6b477dba12b971b9b9
Link:
https://www.unpac.me/results/51ce2ca1-975d-498f-910c-337e17bb0396/
SH256 hash:
13cb5381ef79e46b1b4ee48c75b8a1a3768c8462183b316137fc51b0d98002f2
MD5 hash:
7c5f93610721117622f488bd8f476e60
SHA1 hash:
90394696ac147dd9d8d0fa1bcae1c93abf8dcf75
Detections:
win_404keylogger_g1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Link:
https://www.unpac.me/results/51ce2ca1-975d-498f-910c-337e17bb0396/
Parent samples :
d41022d91ed5c237cbcb1cfaef080005bf5dae114f06418c873596c6c0149a11
f8591a5b43f62cdd88b1e86812b7360ba8e9b41b2780f8df5f276fd4298f4db8
c2f71c006d57414ecfcc0a9718779ae6f19c63ff7ef6738c4a5aa7c38e28d77e
b43a26bba9392c41659ef71c0ba10b4c00d641646c002a64cbe11d09fc4f5cd9
10f246e9a23f84a9e80787e654d3f5612eaded3b992ccaa7a92a94ce8676e40f
ad188854da20c440975e7bf1bfc218c1917da6d7155c77b8c03fefc148ac1759
4ed89812437a80fce23d4c00bafc70da61f00f23f8c0132863385686c2e8a06d
946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff
67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
SH256 hash:
e4e8b92ed5d6609837dad190b6e105bbef5521b63265c0aab93c389dfab71faf
MD5 hash:
27b48e9787fce5e8b43c1c85bfb3ba5f
SHA1 hash:
f560ce49d13844b1874542f04188fc7acd475694
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/51ce2ca1-975d-498f-910c-337e17bb0396/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/67afaa018db2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:VIPKeyLogger
Create hunting rule
Author:kevoreilly
Description:Detects VIPKeyLogger Keylogger
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31993/

Comments