MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 15
| SHA256 hash: | 7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8 |
|---|---|
| SHA3-384 hash: | 7e0538e4eb85bb2e251dfed72bd21a6d13f5868b08009b0b456ed86c5d20db12b9511cd3df2bfb941cb5ee1f49e17128 |
| SHA1 hash: | 6ae1a9be3bd240aebfcdf9c56db1aa9a9abf0948 |
| MD5 hash: | d4a9ed39b93bafab5caea116ad527537 |
| humanhash: | eleven-fanta-quiet-video |
| File name: | 7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8 |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 537'600 bytes |
| First seen: | 2025-09-05 13:10:04 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 21371b611d91188d602926b15db6bd48 (60 x Formbook, 23 x AgentTesla, 20 x RemcosRAT) |
| ssdeep | 12288:Yz7hU5I5yuNHIgzSFKxWltRohBfSTso93UM7jPn+KMiCD:Yf+iN57Gtene3HXnYh |
| Threatray | 2'425 similar samples on MalwareBazaar |
| TLSH | T156B41292A9C1A965C1407330C832CC904A7A3971AD56732F836DF6AFBC74383EE6765D |
| TrID | 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
52
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8
Verdict:
No threats detected
Analysis date:
2025-09-05 20:05:21 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.1%
Tags:
virus
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Blocking the Windows Defender launch
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
autoit compiled-script fingerprint lolbin microsoft_visual_cc msconfig nymeria obfuscated overlay packed packed packed packer_detected threat upx
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-08-20T21:31:00Z UTC
Last seen:
2025-08-20T21:31:00Z UTC
Hits:
~1000
Malware family:
Snake Keylogger
Verdict:
Malicious
Score:
99%
Verdict:
Malware
File Type:
PE
Gathering data
Threat name:
Win32.Trojan.AutoitInject
Status:
Malicious
First seen:
2025-08-21 01:05:05 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
28 of 36 (77.78%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
vipkeylogger
404keylogger
Similar samples:
+ 2'415 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Score:
10/10
Tags:
family:vipkeylogger collection defense_evasion discovery evasion keylogger stealer trojan upx
Behaviour
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Disables Task Manager via registry modification
Modifies Windows Defender DisableAntiSpyware settings
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Unpacked files
SH256 hash:
7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8
MD5 hash:
d4a9ed39b93bafab5caea116ad527537
SHA1 hash:
6ae1a9be3bd240aebfcdf9c56db1aa9a9abf0948
SH256 hash:
58617ee35aab45b69b4fd65f60365129a054f8864820f25d87669c21d79fb9d4
MD5 hash:
79dcead21ecf0a8c3d84aabcdf7dd90e
SHA1 hash:
e9f2e70516ccaceb16bf3d211b5c75744554fb1b
Detections:
AutoIT_Compiled
SH256 hash:
e0e45f9bda3b9ec063458d0fcd14decc1ddb78fbf61f70a9289ff00ff76f275d
MD5 hash:
60fc268edd0e883d7d139d7680d301af
SHA1 hash:
dc6d1bbc5ef1409fc0aeac4025f71df005a5254e
Detections:
win_404keylogger_g1
INDICATOR_SUSPICIOUS_Binary_References_Browsers
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_AllMal_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
| Rule name: | crime_snake_keylogger |
|---|---|
| Author: | Rony (r0ny_123) |
| Description: | Detects Snake keylogger payload |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_DotNetProcHook |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables with potential process hoocking |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables embedding registry key / value combination indicative of disabling Windows Defender features |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_TelegramChatBot |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables using Telegram Chat Bot |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | telegram_bot_api |
|---|---|
| Author: | rectifyq |
| Description: | Detects file containing Telegram Bot API |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_3 |
|---|---|
| Author: | Kevin Falcoz |
| Description: | UPX 3.X |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
| Rule name: | Windows_Trojan_SnakeKeylogger_af3faa65 |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.