🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88
SHA3-384 hash: 2a8d52d56a3b229754de567e052208cef38da42c5cf08bacd8c613195dd527f5eb4966f14b657ab94443c9e1b1aa3b03
SHA1 hash: 97d200c8a83c00291ceec313083719737d4bfe46
MD5 hash: 79f686a73d247ee7ec7035aa9e1e82ae
humanhash: hot-social-table-floor
File name:RFQ-09580-MQ-05868-PR-0686-04-2026-ADNC-05868.bat
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:985'600 bytes
First seen:2026-05-05 06:54:09 UTC
Last seen:2026-05-05 07:16:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 24576:iRRYkB+Prt3wgNcqHjfC+1w9Fo/+pZ3bRPk6s:gOPVLNcwv2Ff1bZs
Threatray 12 similar samples on MalwareBazaar
TLSH T1BD2523B82349C713EA085BB51D70E37213B94D45E555E34A86FDEDE7B8A93326838780
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter jahlives
Tags:exe exe-in-archive SnakeKeylogger spamtrap

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/808bf9f6-66b4-489c-9236-aa009d74e1b1/
Malware family:
n/a
ID:
1
File name:
_70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88.exe
Verdict:
Malicious activity
Analysis date:
2026-05-05 06:55:33 UTC
Tags:
auto-reg evasion snake keylogger telegram spyware stealer
Link:
https://app.any.run/tasks/f8899790-e31e-4e9f-b85d-1a4af1564dda

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/64531/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.39568426.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
DNS request
Connection attempt
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook krypt masquerade packed phishing unsafe vbnet
Link:
https://www.filescan.io/uploads/69f994252fcb905ec27f6a76/reports/9950bb7a-9ae6-4f92-a1af-eb60d6b67531/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-05T03:56:00Z UTC
Last seen:
2026-05-06T23:47:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.Stealer.sb HEUR:Trojan-Spy.MSIL.Agent.sb HEUR:Trojan-PSW.MSIL.Agensla.gen Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb PDM:Trojan.Win32.Generic Trojan.MSIL.Dnoper.sb
Link:
https://opentip.kaspersky.com/70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/52205c90-7dac-4b45-851f-60eb5f1d59d7
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86
Link:
https://app.malva.re/file/79f686a73d247ee7ec7035aa9e1e82ae
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogge
Create hunting rule
Status:
Malicious
First seen:
2026-05-05 06:54:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oc4ottlusi2wdtnzmvbzyw2mcughy3g3j5p6n2i2r2d7isvgzkea._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
4e42b7943ef7edb20e482685f3662e46c405330b790ee8aeebf75e8a87e2b33e
SnakeKeylogger
70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88
SnakeKeylogger
71b2457ddc24360563eb07fe7fac84203c695dcf726d1a1f91028b86f2b9a232
SnakeKeylogger
8e90855ee1b934e6abd95c91bd321f90ee396639ba86f9157d421965542f1f04
SnakeKeylogger
error
SnakeKeylogger
+ 2 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger discovery execution keylogger persistence stealer
Link:
https://tria.ge/reports/260505-hpfplshy6v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: VIPKeylogger
Unpacked files
SH256 hash:
70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88
MD5 hash:
79f686a73d247ee7ec7035aa9e1e82ae
SHA1 hash:
97d200c8a83c00291ceec313083719737d4bfe46
Link:
https://www.unpac.me/results/256f0c7c-95d9-4f18-851f-70882e1bb839/
SH256 hash:
50b044fdf6ef68f9c4651f2058b889e7199ed9882342e5fbcb65c0372fc3498b
MD5 hash:
e741b14e6d5b9cb132b29d72e45deba1
SHA1 hash:
4cd3be0545d2cd03bc177e017ebc29b544cc4d2e
Link:
https://www.unpac.me/results/256f0c7c-95d9-4f18-851f-70882e1bb839/
SH256 hash:
c8635b8744e9edb9abb177884ed74a6a3ab0797393cee1b62e3fe80827ddfd37
MD5 hash:
5d965050ee18312be7105ec78291dd4c
SHA1 hash:
51650b93008764cef670e7b851fe375b114074e7
Detections:
win_404keylogger_g1
Create hunting rule
triage_snakekeylogger_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/256f0c7c-95d9-4f18-851f-70882e1bb839/
SH256 hash:
2491656bd308e87cf0f6afa6dbfa5ad746185cfeacb125a3446c60a02d74a5c2
MD5 hash:
377f14986243596947fef518c043be55
SHA1 hash:
9f3c1f80285c291c9217a7f7e51ca8d92363faf3
Link:
https://www.unpac.me/results/256f0c7c-95d9-4f18-851f-70882e1bb839/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/70b8e9cd7492/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70b8e9cd74923561cdb965439c5b4c150c7c6cdb4f5fe6e91a8e87f44aa6ca88

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/64531/

Comments