MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 17

Intelligence 17 IOCs YARA 18 File information Comments

SHA256 hash:	8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a
SHA3-384 hash:	bb23240b02674cef96b58d1c84e69c198e3a012ddfbcbc7f5bfbe0c888f3fe175566ff0bc3078e592f5153dce9678e55
SHA1 hash:	784867a6c3a76e1947919914e166411208fd1e4d
MD5 hash:	a72fbedc6515423321246d11c82db58e
humanhash:	timing-utah-triple-single
File name:	ISLEM ÖZETI_70868191-1066-1034 19082025 nolu TICAR.pdf.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	811'520 bytes
First seen:	2025-08-20 12:33:53 UTC
Last seen:	2025-09-05 12:56:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	12288:MXTOwBxSGxz9MVl8d0lGEskv+7MeLYLNB9HcsUEgZn0g2cpL5/XUJm5Kzhan23nw:MxBEGxml8mlX+sL79Hn2Zp269kE4
Threatray	2'663 similar samples on MalwareBazaar
TLSH	T11505CFAC3200B99FC457D9728DA4EC74AA646CAA930BD20395D31DEFBD0D696CF141E3
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	lowmal3
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ISLEM ÃZETI_70868191-1066-1034 19082025 nolu TICAR.pdf.exe

Verdict:

No threats detected

Analysis date:

2025-08-20 12:37:28 UTC

Tags:

netreactor

Link:

https://app.any.run/tasks/d482543e-6a6b-41c0-b71a-beefbc388731

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/22472/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a5c0dd8fd55a79c5296df7

Tags:

agenttesla underscore spam

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Creating a process from a recently created file

Creating a file

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Stealing user critical data

Adding an exclusion to Microsoft Defender

Forced shutdown of a browser

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated obfuscated obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/68a5c10bba1f5bb1e60de53d/reports/abe2e395-7f01-46a6-aa6c-0c3005791591/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/683de359-29e8-4dde-9ec0-d36593685424

Result

Threat name:

Snake Keylogger, VIP Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1760970

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Antivirus / Scanner detection for submitted sample

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses the Telegram API (likely for C&C communication)

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a

Verdict:

inconclusive

YARA:

12 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.83 Win 32 Exe x86

Link:

https://app.malva.re/file/a72fbedc6515423321246d11c82db58e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a/

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a

Threat name:

ByteCode-MSIL.Backdoor.FormBook

Status:

Malicious

First seen:

2025-08-19 16:20:10 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rtcgqtk3jra5wba2zk3fkds5ruiqc5nu3iw346o2as3czuq3iefa._file

Verdict:

malicious

Label(s):

vipkeylogger

unc_loader_037

SnakeKeylogger

9957870d8b4fb238246540cf95e7c1b0a3a5d1ddb4d94628c4d6c11be9c7503e

SnakeKeylogger

a239e5544a81a4b552f1ff3b273a60b04f527e940e39a7981c135f7088b9597d

SnakeKeylogger

bea5e2297d603061b7622f0a4203b9698b708564c38fd53307de832542b2c8e9

SnakeKeylogger

e9b41f0fbd640613e949417dfe2cc1835e4458e1c20c766b0331274da1f53c79

SnakeKeylogger

+ 2'653 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection defense_evasion discovery execution keylogger spyware stealer

Link:

https://tria.ge/reports/250820-psdsrafk5v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Modifies trusted root certificate store through registry

VIPKeylogger

Vipkeylogger family

Verdict:

Malicious

Tags:

404Keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/97d87c64-f997-43fb-bef2-e6f24947386a

Unpacked files

SH256 hash:

8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a

MD5 hash:

a72fbedc6515423321246d11c82db58e

SHA1 hash:

784867a6c3a76e1947919914e166411208fd1e4d

Link:

https://www.unpac.me/results/38a13b1c-7aef-41b9-9eaf-46035ad19b74/

SH256 hash:

27e5ffda53751e7360f380bd82a3176a7875a555f6af5b130fb2d64ff776c895

MD5 hash:

68845a1d0f6c65bb7ecc09ca76d2f005

SHA1 hash:

0145c4314c2cf41ae583bb32784fe780c1cdaf1d

Link:

https://www.unpac.me/results/38a13b1c-7aef-41b9-9eaf-46035ad19b74/

SH256 hash:

a0f661709e2b5a34e13d362ad8cc7157821e9059b2720c8a334ccec2e3a9d703

MD5 hash:

31cc6da388beb94237f9aa46eaac815d

SHA1 hash:

3d65fc7902fc1b4d752db2d9f1b02d3bf9b50b46

Detections:

win_404keylogger_g1

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/38a13b1c-7aef-41b9-9eaf-46035ad19b74/

Parent samples :

00d6bcb13a0e5ee0a759c663a63d75866a7ceacbc91e3b63d96580926c5053af
e9b41f0fbd640613e949417dfe2cc1835e4458e1c20c766b0331274da1f53c79
88b838cc854132e243dc0e2d3ca34f49f0de3c96d5b2bf15b0901bed270702c1
a7f7a2ba4874202dd3c17d81618c0f5f03421b13fe9b48a81f475025f97f2fd3
dfb47b0d9362c1584332c02f37e614f8e54a3f9956cc3df38dbacd20c40c4db5
c43e60dd4fe89c7a4927b13c24972ff021986196b1fafa40e9cdc5ce81b0db5b
8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a

SH256 hash:

7f1e1f6e1678c134494debcf1f2b58d485dd2e5fb14e86bce7d35f1229d165b6

MD5 hash:

22807445b5ee1a87e51a6650b4f943bc

SHA1 hash:

626892d595fbd3d34166c676ae92ff1e1b5f82bf

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/38a13b1c-7aef-41b9-9eaf-46035ad19b74/

Malware family:

zgRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8cc4684d5b4c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

exe 8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/22472/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample