🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 18


Intelligence 18 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
SHA3-384 hash: 46a41837bbebe054ec7bdf7d7da60a72ccf3a8ce793e72a8f34d3dfa19721106e3b2130e204c34457566a79578256688
SHA1 hash: 3df7997d42a165ae3ef933ae46fca5bd1ad83567
MD5 hash: a2f467fb06f9d893c40da9ef9a004cd0
humanhash: yankee-table-lake-uncle
File name:6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:909'312 bytes
First seen:2026-10-14 16:08:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'615 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 12288:lkw1iNvHH6SZzpX8zm3iGIvQrJfAmr/4ZL2autpn2blySnu4kWzMaXFAyU7OU:lkCKX8+i4rIgautpnulyMu4PrAym
TLSH T13A15AEAA3AEEC82AF0761F70C5E1F2F247B59D41E611C2078AD57DD73936B80168634B
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter ShadowOpCode
Tags:exe RGBLoader SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
IT IT
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/de45b72c-580c-4f31-a86e-d0b8d1de6a18/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
https://temp.sh/HVmiT/RGBLoader.zip
Verdict:
Malicious activity
Analysis date:
2026-10-14 15:16:47 UTC
Tags:
rat pulsar netreactor ip-check evasion stealer agenttesla ftp exfiltration uac xworm screenconnect rmm-tool smtp ultravnc telegram snake keylogger
Link:
https://app.any.run/tasks/4e9aec16-036a-4d91-93e0-a1a6602cbb3d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/91940/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3664.28566.28199.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad170656f551121ba1665d9
Tags:
shell virus cupi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a service
Creating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Stealing user critical data
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
entropy net_reactor obfuscated packed packed vbnet
Link:
https://www.filescan.io/uploads/6acfa90b6f2a1f7b50d55d21/reports/a65255ba-198d-4286-8491-8177ba3166de/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-09T06:56:00Z UTC
Last seen:
2026-10-16T08:25:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1825771d-bb29-421a-9de5-eb498f73c6b5
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
Verdict:
Malware
YARA:
12 match(es)
Tags:
.Net .Net Obfuscator .Net Reactor Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.63 Win 32 Exe x86
Link:
https://app.malva.re/file/a2f467fb06f9d893c40da9ef9a004cd0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-10-09 12:55:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
31 of 36 (86.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2b3bnunoyhoftx6tun3u7ky6gm7itpkfvzjy7dk3pmutbdcqgrq._file
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger spyware stealer
Link:
https://tria.ge/reports/261014-tljgwagh34/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: VIPKeylogger
Unpacked files
SH256 hash:
6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
MD5 hash:
a2f467fb06f9d893c40da9ef9a004cd0
SHA1 hash:
3df7997d42a165ae3ef933ae46fca5bd1ad83567
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/1ad3ee4a-ce8b-4607-9fff-d2fd9dc9282e/
SH256 hash:
405d0dcbe8454646de26e8b2db78435803b99dccdcbcdaa1028c56c7c0c6c3ec
MD5 hash:
3e3fb75f3074003ae2ff07ecfe6fd38d
SHA1 hash:
5200f5572d3167c84842bbff7c48506011585172
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/1ad3ee4a-ce8b-4607-9fff-d2fd9dc9282e/
Parent samples :
64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2
354ed74cf297bdc4d920e3bb357fea7202856277501cbe914b1dfbe8813e841c
7a9bffbf3a920d9b72d73b73cf09f3be5dadf025055f42b5dd12761ab7c8dd34
461ba9a7d6b344421967b3c71630ec4796126b5f20bef32111447ac58e9b9202
a36cbacd3c6950de6319523835e895e8b35e32549c3a4673b3ead5215ad0d3e8
a8a6f5ad5f6bc59b64af1cca3bf0d5b6bcc8686a0dd8a8bb5cb244c2edcf3e23
4e2d3b193a9bfb9f3a369a251a1b722450fa13d8fc193d3c872ebf1062783fde
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
e15e5d4f77fa217cf9ccf18fc0fff19e9b9e47d8c65413f2751904a14fcb8658
024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da
db4732a4b2646f6ddef351784943f58c27311215807a9ba670e9f687366e2a43
b7e0ed86028fb5faa05901945ae751051dc29ac8729b1afc62cc6efe17e20c0a
012ff5e0a2bed3ffa624958ccbc9da37a26f2fb65e3b994fec9d51b2debd2e39
0264d0104ae89e9c45fd1ebba3a20425e8f41cdc16e7deacec9d9608afcf8230
08e7a6e924c4e87cea2db6050812e058786714e788957cf0763b7d68943068c0
090fe0632814513fdece4b3c602cbcb5816f8e6b0b7a34ed73430ef6816ca227
152d4753839330b04a221d9e97093de27dcf5a4231fbd948940da26d909dd5b1
19b4de88df623cf3d95a7c3e84cdb51070360c4127322b5a929e9143d242d7f0
1af881666fdf368406d50e86d289b42853d9fc220cace6e82c5f0ee157d9bfae
297dc82be0b18123280967f224ce6ca4843b22e3b1bed07eb82cde8f78cdadef
2dc39c7548cdf4ccb0f00d94768aad3a3031c1ed29a24a59499bb6d558808c26
30a633cd9f1c25e9f76cdc78c3565462f14a444fe13f0689fe41de2163a89bd0
35bb5a32f866cf66288451eb5f04c568d58ae85dbd5b876abdb84932275215ae
3cbd641a2454d3b71544edd13f8b1940df511f3b9720555519bdc9740adb16e3
3e2aa99f1b2a0d56f34f65de5dcafafda48c23433881aba479bae67072059b56
4018da487297614f041f01b5bffe425f6a4ca43b045455b4c4ac20c04b92a61d
45d3d2858dff39d3c088b51b4b4c9452e562a85edf68f4d135ac0c69e73a0d75
4cfffae6cdd242838185f34113b65421a41ee3fcc726b8fa63c05d607164af4c
525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
5390935b00b4bb841bf005d0e43b603a78139295ea53b471230d24bdb5c423d1
5aee04c320bf3ed7046702eafa8c4e193a614981e955c98cf82bdb675edbecdd
5bf661ed804f6f8e0f65e3f8d3799873f72de9d486a5ffd71b79a62012f1fd83
676e61504a6d6ab4d90b5068bc487fb19c804b0b1ef0db814aa04fbe035195dd
68ca49836efe920aaad82f3db71bd22a9fb5bf72490f1535f1f7f2697f120a55
6ad2165eaa8bd199768ccd7dfe74a480e0602bd57c6a77501d01faebadb85e14
6bdf803d22cfdff13e317894ddbec9076aa67d85422414ee7d12a1d44c6b0fc1
6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
74615f020e5952fe66c8367ca324ce02b0ca3e98bb17327cb159181830b8e23e
785de4b2439f127566906ab1abbaa80562fdb730bc0e5c3f4d0d0c6a5af5330f
78ffe41ede09473d54e4808e703eac44cd6e79e2314c84ab4539c57ac0bf4033
7946937f5c65fe8d9f39b927c9a499917e72d88640cac1e34227758f241413c5
7f69d304597c8b10d0f5516fae40ef1db11030d68778464402d3cdaf3f586b41
86c321273fb1bae6a89344a1b8982b80d13c0774bb76a0e3cdfaeab1c4d5dd17
88f4f68676a0adb716b617a6276bc4f28bfb1fc732daca54c1582f70a124d86d
8d93bc348fc3702b7b5bd244f0a1fca04cf34903a72f18cc883e6b1333722644
9d66a32be3f221f882724bbd6aa9824232cbaef71ea46243b1c6927a9c569387
a924dc51efcc327e23837f61af68d2f793d36a36183c3cedb3987efca8382583
a995a81f862dc9994a8021fecfc55a7f8261974f50793e7bd8a73dab5e6b33a9
ab3d42f5dc68cfd3507849160e1b5f90589c49f1bc8aea1226a1dea6e2824c05
b059899fbc3393df19a209fa6c7faa35de15b2886c51572828f7f1e1d1088e87
c053108c5b25c38bc6d29569d2876396f4e744cad3d867abf4e566b3e4c3c384
c520275b04c1fbdabdac631aaf4141cd3fd8bc485aa9cfaed7c65e7ccac12c14
d5331e2c9e5d866d4515c825d6eb69de927810f8547fdc9dfb0aa545785a36b6
d86753e540f7ec56ae0e03335558af87e536c03bdd7d93511a5521ee28605341
e13ed2a8812eac03651272dfd4ac6a0431305ac845210907bea692dc59105526
e357b50c1c476180923e06378e54a7995e7966dbd633c3fe6edea1432c425833
ec340fcd3a19f99978cfd326a00108ce04d9c295ef61723dfe12c46fc8be21b9
ee173fe306d7834864d41b0d02327027a736c2f8517a6831da52b1b30e9a0d72
ef731669a765d81e3afae2c4f04cb729dd28c30a8fd60fa800ea6e10d2732011
f5b83f8a1394e025adad0de20e351321020d7d24b98ceafc9222b71c6a6f48cc
SH256 hash:
aaa8d34751aeee66325b00a936757b1411000987c5164588e240ad336ddb0d1a
MD5 hash:
6b3ebad0a0bdceeb54fd43e08e58d448
SHA1 hash:
a059c4edd5c4c4d03fc264ecff2c2422be615e48
Detections:
triage_snakekeylogger_infostealer
Create hunting rule
win_404keylogger_g1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/1ad3ee4a-ce8b-4607-9fff-d2fd9dc9282e/
Parent samples :
db4732a4b2646f6ddef351784943f58c27311215807a9ba670e9f687366e2a43
6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
a7fc92c7f72e1efb7a2a1eb11b0a80a8ef39e1aa0b44c917749eb93eed4cd481
a924dc51efcc327e23837f61af68d2f793d36a36183c3cedb3987efca8382583
SH256 hash:
de6e7ef959298758b3a7abe5948ebe5d23553d420df53d1c72e1a5e1f3a7a928
MD5 hash:
bb302ffe6388a161735354a0265fa478
SHA1 hash:
a2b34428524fc3bcbfe28ed1ba2b0cee49ca7ff1
Link:
https://www.unpac.me/results/1ad3ee4a-ce8b-4607-9fff-d2fd9dc9282e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91940/

Comments