MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 19


Intelligence 19 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
SHA3-384 hash: 35c0f664a6726537ef70f11731ed4b543fc6f7889fa2c904b7722a3d8c40edafdee456b5a986cb529b8eb31b09b498b1
SHA1 hash: c311ec76dd00196b0025e17f895b8f181d56e696
MD5 hash: ed516b6d60f1a64bc0ebef125d408fc8
humanhash: idaho-sweet-triple-yellow
File name:rREQUESTFORQUOTATION_20251125_PDF.bat
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:665'600 bytes
First seen:2025-11-25 07:30:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:zkeOeL8d3GxQWh1GS0pGjFiSbFPseuV7pTGsyzYIP:IeI3GxQWh1oSbFUeuVVHyzYE
Threatray 6 similar samples on MalwareBazaar
TLSH T19BE41264227DDA57C8A2A7F205B2D23563B81E9EE812E3078FC9BDFFBA01B054451753
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter FXOLabs
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rREQUESTFORQUOTATION_20251125_PDF.bat
Verdict:
Malicious activity
Analysis date:
2025-11-25 07:32:32 UTC
Tags:
auto-sch-xml snake keylogger telegram evasion stealer
Link:
https://app.any.run/tasks/d27627e0-314b-44d5-b7ac-685eeeb55846

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/41421/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69255b465d7fac83ebf2bd68
Tags:
backdoor shell hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed vbnet
Link:
https://www.filescan.io/uploads/69255b1edeea95d50b268bb8/reports/4fc263d7-d60d-43e9-8d82-29faf5a7469c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-25T04:28:00Z UTC
Last seen:
2025-11-27T02:23:00Z UTC
Hits:
~100
Detections:
Trojan.MSIL.Taskun.a Trojan-PSW.Win32.Stelega.sb Trojan.MSIL.Inject.sb HEUR:Trojan.MSIL.Taskun.sb Trojan-PSW.SnakeLogger.HTTP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan-Spy.MSIL.SnakeLogger.gen Trojan.MSIL.Taskun.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-Spy.MSIL.Agent.sb Trojan-Spy.MSIL.SnakeLogger.a Trojan-Spy.Agent.SMTP.C&C Trojan.Taskun.TCP.C&C
Link:
https://opentip.kaspersky.com/707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/10ff7b4f-23f9-4ebd-b597-808c951c7313
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.38 Win 32 Exe x86
Link:
https://app.malva.re/file/ed516b6d60f1a64bc0ebef125d408fc8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-11-25 07:06:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ob75v7cwxfu45uhxsazmozw2ffmca2foeyyaotwi2qoe2u5hg5zq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
5fc5368bad8a8b519f2c392b97c458d9425307b00d52aaadea20eba58e8eeb24
SnakeKeylogger
707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
SnakeKeylogger
e11a0dcca950c7f8db943cd71e152257264d9cdfdb0a8ddf23b5e9ebe07daa4f
SnakeKeylogger
error
SnakeKeylogger
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger persistence spyware stealer
Link:
https://tria.ge/reports/251125-jb5x1stjck/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/24776cf2-3cf4-4d64-8fc9-1369cd0c5d3a
Unpacked files
SH256 hash:
e8f5d48a02b3b97db1cf2ace86f04e3b13a7d0f2c49a0916a06a4d02d19e7d10
MD5 hash:
60d450345965e0ee9033aadb60642045
SHA1 hash:
0564a81fafb3c887984e5d2e775916eed6fc6a4b
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/3c93dc23-004b-4241-babf-4fe611dcc0af/
SH256 hash:
3aa8ce5d4766e6fa27c0f3e031c1425b79322fc25ced61c68998ddd0fe84afe0
MD5 hash:
62963935f4f4a7a5d71e15077781146b
SHA1 hash:
374f566ec38e44ea82e0aef8c79417067b37f003
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/3c93dc23-004b-4241-babf-4fe611dcc0af/
Parent samples :
5fc5368bad8a8b519f2c392b97c458d9425307b00d52aaadea20eba58e8eeb24
707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
ac7a2d43da192df88b772d5f18ad2fbfff501236b4593c0e608474fedde91508
a0f0d732fb63ac2e8801fb5f3a7f969952a7fbdb8b2a782c64cb1c1c14bda72c
4528e9b7d05236ab6a225911e8978af4a7d49bc0221b5529d40ee85b60b0dae7
0be718f7b7a74c02cb6e13cf89c32e36e3385d3c8d6bf11459e8a43afafe4ab4
35c4d93f942a492df6f2c7a905cc0c05d8d0013f8361ef0453762ce8ed74a6c8
93d8f58337eb1309d7fadafe6707dde3a7d20d65870d05a689b3c2f264e61193
74ace00f731591af315dda87a91dcad538db3fab7a62d9e8612eef59dc128bde
e7a7b1d0ebf9cbb2760f3795b42b1b39596ab0eabf1cb12417ba2e8e42494708
SH256 hash:
5e7a3d40425e1801803391ea74f975cfa7c2966d4bfa63f51dd56b05dd0a1765
MD5 hash:
a81cebe821e3a2eba8fd028087a3d8b5
SHA1 hash:
6474b48ee92bbe1312fb82f38c4faca1e063ab23
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3c93dc23-004b-4241-babf-4fe611dcc0af/
SH256 hash:
707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
MD5 hash:
ed516b6d60f1a64bc0ebef125d408fc8
SHA1 hash:
c311ec76dd00196b0025e17f895b8f181d56e696
Link:
https://www.unpac.me/results/3c93dc23-004b-4241-babf-4fe611dcc0af/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/707fdafc56b9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:VIPKeyLogger
Create hunting rule
Author:kevoreilly
Description:Detects VIPKeyLogger Keylogger
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/41421/

Comments