MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Intelligence 17 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5
SHA3-384 hash: c145af49534e51072f20a933f30a7b898aa56ce32a6847fe1e7c31e55d21ed5de1c367bdd60262429efb83a654676ac2
SHA1 hash: 1e00e141d152a4d2553b6443f19a464e7422ef6a
MD5 hash: 704fe577bfe06fccb0112962138d0676
humanhash: mango-nebraska-double-maryland
File name:invoice for payment.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:774'656 bytes
First seen:2025-05-19 09:12:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:W+wH3KDqRdudVjH6BnwJqLJ0mZWLnKyTwvYkToVKsY3oFvlHWshblF:9wXOqn0R2wqDqV6RTogsHDHHhb
TLSH T105F4E0243E598B03C4AE4AB4B873D3771E655F9FA611C2879AE73D9B36E23305543382
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 20e631ec86b2b2cc (6 x SnakeKeylogger, 4 x MassLogger, 3 x Formbook)
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
455
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
invoice for payment.exe
Verdict:
Malicious activity
Analysis date:
2025-05-19 09:34:00 UTC
Tags:
evasion snake keylogger telegram netreactor stealer
Link:
https://app.any.run/tasks/751ca88c-395d-4338-a1f3-9d4b21d73e3f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BackDoor.AgentTeslaNET.6.21227.20757.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682af602375681df7c1aa493
Tags:
virus micro spam msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Forced shutdown of a browser
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/682af5f8c609634bd7c8b94a/reports/e0cfa8e2-63d2-411f-ae5e-ad2c5e9a6dc5/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/33c92bef-a0a6-4646-a623-5f86d1d141ce
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1693857
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2025-05-14 03:03:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o3zvzdwovef3s4e26jhzda2itjyr6bh4adzg2pfoot54355543cq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
SnakeKeylogger
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/250519-k6z6padn4y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
404keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/0e24ee89-d09d-4f88-a898-bd72d85423dc
Unpacked files
SH256 hash:
76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5
MD5 hash:
704fe577bfe06fccb0112962138d0676
SHA1 hash:
1e00e141d152a4d2553b6443f19a464e7422ef6a
Link:
https://www.unpac.me/results/d3fadc68-822c-40b0-ab86-9d7cfd0ffe82/
SH256 hash:
e65bc4732f18966eeaba9700bb83489074f63082cf28bc05e90d278a1761ac25
MD5 hash:
f568aa0b7be96ed2102e8de46d59248b
SHA1 hash:
5031c8d479988ff22716c13646fc6ba8cd6a78d8
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d3fadc68-822c-40b0-ab86-9d7cfd0ffe82/
Parent samples :
eba602f26ca14d5e494059001ecf363110ba504d9e0184b8abfa45905bd650cc
3ff3db68a75d4c52f3910396564f35999b3571ed75850df0c403b851433582ec
285bd22ba49a3de603e9fff856a0bd3111e43629ad29e24bb41178afd93ece23
54f015287731308328345efdc18a593d3b5a57efdd04278efb9da7f5127df37f
ca081d2e9e512e1516edc180262c4309dda83ad714a281abd26fc1a658bced01
c3f39d499f8599e009697219a0c0f9b5fd91848b693fcaf4abdc0d15bdc67de0
44123cf2ed8f575c4643cacfcd51e18188edeca34b343af433c98ac03fb691ea
76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5
d539ab19fd873bd36c22b38f3d8a85683220a7bcce13a9c962652d6165c33c2e
ef9e1440789a46cd00ebe7bde8526eefd00e6d1363299d3ae3c1b01e891d7b35
SH256 hash:
7f40d2ac072c7306968a78133fdef11e928cd2e620183cbdfa552cdaa620db01
MD5 hash:
da0a6910c4ae63791ab88f168e664485
SHA1 hash:
6ed7e3b2c51c0c6160fa72fed846829d33f9edd9
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d3fadc68-822c-40b0-ab86-9d7cfd0ffe82/
SH256 hash:
4cfe094f83a11e6b35d11c610121f83bb28152960c775bb5c62c6e5e1af4caab
MD5 hash:
aa1238f5d903f16b683f1ee60ba0e111
SHA1 hash:
ba7b45f666f7bc2381c96caf892b1a01fa2b7951
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/d3fadc68-822c-40b0-ab86-9d7cfd0ffe82/
Parent samples :
76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5
bd9d4a2d5627b27b2e43afd37b07ce6c6b2d64a7017def2020c2c1434eae1a2a
4cfe094f83a11e6b35d11c610121f83bb28152960c775bb5c62c6e5e1af4caab
16e98f38ce60581b593580dd757e715ae01e5127bfc357d10848542852ab8a5e
3f246886e2aa75ace2f041adcbf78ba154f2a0f259e47fbf4a4aaef7db6129aa
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/76f35c8ecea9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 76f35c8ecea90bb9709af24f9183489a711f04fc00f26d3cae74fbcdf7bde6c5

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments