MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 681fba7a7c90b437f8e6575e896599912e7158973aea9d98ae836c27023f9748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 7

Intelligence 7 IOCs YARA 9 File information Comments

SHA256 hash:	681fba7a7c90b437f8e6575e896599912e7158973aea9d98ae836c27023f9748
SHA3-384 hash:	5eeba27552e0e758c486a32f5b1979af26ec9268917165a8051ddddc494943112efa684b53b4bae0cd04fbc2a891dc8b
SHA1 hash:	0c904f006171ac7a9af18a46a4261b7f8e39ccd3
MD5 hash:	e9fce896bc4c62d1c2928bd68a4c5bb4
humanhash:	table-whiskey-finch-mars
File name:	製品お見積り依頼.zip
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	655'237 bytes
First seen:	2025-06-27 07:57:08 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:D82UU7epd9HJFyk4gRvytiE1uVrvo19Q9lODZKTChPiRSA860RMTo1BLOiI4p:D82K3aUAnIVU1q9lODZ2xEL60Rj1wiZ
TLSH	T1B4D423BA8CA63B3C8DA893A1C0E9B34BDE75B49E9FD52767B8C4D475D810E739013604
Magika	zip
Reporter	serosero
Tags:	SnakeKeylogger VIPKeylogger zip

Intelligence

File Origin

# of uploads :

# of downloads :

367

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	製品お見積り依頼.exe
File size:	736'256 bytes
SHA256 hash:	5cd2fa8f1a6122349cd41168d49ba607197f5e071511478b10250ac99b12fd47
MD5 hash:	0f28b24eefda6347796a437c997ae169
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.3323.15868.31709.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685e4f0037c343677946892f

Tags:

keylog spawn word

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/681fba7a7c90b437f8e6575e896599912e7158973aea9d98ae836c27023f9748/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

dotnet-loader entropy obfuscated packed packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/685e4f0845e80b29f8a1415f/reports/8b7367da-183b-4754-b780-0b6e5bb977be/overview

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250627-qnpj5azvaz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/681fba7a7c90b437f8e6575e896599912e7158973aea9d98ae836c27023f9748

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)