MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84d52b42a0fa32fa87f189c42f3ae8e3407ae23032d053e0359afcef695b007a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 6

Intelligence 6 IOCs YARA 7 File information Comments

SHA256 hash:	84d52b42a0fa32fa87f189c42f3ae8e3407ae23032d053e0359afcef695b007a
SHA3-384 hash:	b43144b93eb4584c570d62f55342f55618c5c2909ac6b12b0141cd00f3b7ca91217d8f5ae72397235157bc2c76567370
SHA1 hash:	174683ac24fa48009cbeaa8c526a0273094c901e
MD5 hash:	f11f8947c280587bc7aee07e4fc25583
humanhash:	oxygen-charlie-river-white
File name:	SCLJEANSA176924.r15
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	506'894 bytes
First seen:	2025-06-16 11:47:52 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:R3R9lVBaqvxLXZ9jIwW8SI0YATnd14XFeC80O6VKOy57roYzcL60NGJjV7:R3ROKXXvHpVY1446Vjs1spoZV7
TLSH	T1A0B423DDDBAC5A0785BFC311E11C83ACA18B55AFB112620AEE0CB2BD188774DED45787
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	r15 rar Shipping SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: "Bernie Calagos <bernie.calagos@lugintl.com>" (likely spoofed)
Received: "from avenueshiplogistics-kh.com (unknown [91.219.151.61]) "
Date: "Mon, 16 Jun 2025 09:10:15 +0100"
Subject: "RE: DRAFT SHIPPING DOCUMENTS"
Attachment: "SCLJEANSA176924.r15"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SCLJEANSA176924.bat
File size:	560'128 bytes
SHA256 hash:	bbbf76d4e060c93aa7772cdecff4e190a5b29a4a0fe246b471b6b3fac3091aaa
MD5 hash:	a53393a3d39f79c5aa547450fa010b5e
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685004878bd5d68a12e8cfd0

Tags:

snakelogger backdoor virus msil

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/68500486fd02ed5e05ad2f3c/reports/835c9e8c-fb7a-4f22-907c-434a3536061c/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/84d52b42a0fa32fa87f189c42f3ae8e3407ae23032d053e0359afcef695b007a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/84d52b42a0fa32fa87f189c42f3ae8e3407ae23032d053e0359afcef695b007a/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2025-06-16 08:42:26 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qtkswqva7izpvb7rrhcc6oxi4nahvyrqglifhybvtl6o62k3ab5a._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection discovery keylogger spyware stealer

Link:

https://tria.ge/reports/250616-pkrdwaxnt3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/84d52b42a0fa32fa87f189c42f3ae8e3407ae23032d053e0359afcef695b007a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Runtime_Broker_Variant_1 Create hunting rule
Author:	Sn0wFr0$t
Description:	Detecting malicious Runtime Broker

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)