MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
SHA3-384 hash: 3a7475b6212d528802b7913295774df35bc9ac8fc76b45f95dd0001cf687b4670c8863b122cc301b4ae1803fd1232941
SHA1 hash: 69999ef2af86ac2a4f435483a52deb2eb54e3bba
MD5 hash: 26a0ffe8ed7645b7136ed56213b1a176
humanhash: moon-lithium-football-hawaii
File name:8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:541'696 bytes
First seen:2025-10-14 11:04:47 UTC
Last seen:2025-11-06 10:11:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:jxzveN6NtGc3eoz2ZB2lFm2juJbUUcBgThvNC0D9:jxzva6NEsziDlUUcBgrC
Threatray 706 similar samples on MalwareBazaar
TLSH T120B4230F7F56AA16C20D2379DA1331AD08B9C1A9E477F39319C96CB01F5D68A86CBD13
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:exe SnakeKeylogger webmail-ki-lojaobrinquedos-com-br

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
Verdict:
Malicious activity
Analysis date:
2025-10-14 11:05:47 UTC
Tags:
snake keylogger evasion stealer
Link:
https://app.any.run/tasks/b411ebb9-e3d8-4ed0-b77f-6f8a04de02c2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/32665/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ee2e9104e22ce9acd9ec3b
Tags:
virus micro
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68ee2ee271883144ef363127/reports/b37cf9b3-e3bd-4db8-98f4-049738835baf/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-09T03:28:00Z UTC
Last seen:
2025-10-16T09:04:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Trojan.MSIL.Taskun.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-Spy.MSIL.Agent.sb Trojan-Spy.Agent.SMTP.C&C Trojan.Crypt.TCP.ServerRequest Trojan-Spy.MSIL.SnakeLogger.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Inject.sb HEUR:Trojan-Spy.MSIL.SnakeLogger.gen
Link:
https://opentip.kaspersky.com/8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e0c78a7d-d38f-48d6-81c8-0ff87ab99f18
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86
Link:
https://app.malva.re/file/26a0ffe8ed7645b7136ed56213b1a176
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-09 09:34:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2kza7almxzpraw6jvv7nhqlmk7w5if6fkd6ltap7jjv7lkjejsa._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
404keylogger
Create hunting rule
Similar samples:
4ac3f32b582acab1a8cd4db11290c46427621b0d0c1fbe3ee042c7c2f63140da
SnakeKeylogger
93b6fbc6e1478f23abf09faebcf4a36d32720a98c0d14a4f61092d8652c83bfd
SnakeKeylogger
9cb0848b2a33dbaacfcbfbc734430161d65a3408e66ef4b369a9f3139a3e1b3c
SnakeKeylogger
b84cedac3e5e517eae4d37b6add577fd766dcf5626d75a307a04f88c461edf9b
SnakeKeylogger
+ 696 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/251014-m7ktha1py3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c6d3c810-b7e7-45c9-9e7e-5c67ca647bf3
Unpacked files
SH256 hash:
8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
MD5 hash:
26a0ffe8ed7645b7136ed56213b1a176
SHA1 hash:
69999ef2af86ac2a4f435483a52deb2eb54e3bba
Link:
https://www.unpac.me/results/0e0d30c2-08e6-481a-b7f8-c1f77835f437/
SH256 hash:
6c054b73bdab1577bffcb5e5c80f07af61b15720f0b93bcf7ba9a89cc29099f3
MD5 hash:
aeb4d26204eee871c58788de8a9881ba
SHA1 hash:
2a57bf5570d9348abc99e97e974f8d1e45c52210
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0e0d30c2-08e6-481a-b7f8-c1f77835f437/
SH256 hash:
cc2b98223c9dcaf35c31d2eb743780aa3ea50177043e82633dda11aa7b7ff66b
MD5 hash:
014ace331af3642ddb3d3aa754e94950
SHA1 hash:
2ee54a101d1817ffdf1154d6bc19a7fa6db81c97
Link:
https://www.unpac.me/results/0e0d30c2-08e6-481a-b7f8-c1f77835f437/
SH256 hash:
f9eda741e36de984f5764c76429ada284101b74abba47b708ac175c49f8227fe
MD5 hash:
48e1fdaf7662517c4e0f968966d4d7b0
SHA1 hash:
6320e1973e714027f3d4280c125ff36f51848f81
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/0e0d30c2-08e6-481a-b7f8-c1f77835f437/
Parent samples :
2ed366c595c98fbfe00e692f6d7e06dd237bc2fce08070b610e220083bdb1fe4
f9eda741e36de984f5764c76429ada284101b74abba47b708ac175c49f8227fe
b234827824cb6864880f9bcf498b15a4a15511e541906347af53f0cd5ed60290
adbd8b904ab4bea6ff62fa51f68c11a1d1593fca88c8f556510f6a2764d98490
91be01581d30136fc1d54926fb6fee17beb10959dae4ff07c9808c0244cce25c
8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264
74bfc0967b1636ed58fbfc95523775dbef1e084910676b1e13a775095fec013e
626a21b142572a7729f9ee6746af1a1b21378e2f2457f8bfce9bdbe7d1fbe136
4255224f9842c7cb47d5d5d488d2f45674ac540f2b4652618dd2153acd3cd151
27af0f60f3069416ee2be26ee18589448518135832e18ae26e867a95d22d8065
324fcd15e9d6f1b0991ad5943a3178031c608d872cb810eeef48f11295490d6f
5b51788ca1b5ba91fd6f120c8264ea6ca4ae45db3dce9079f741d4e90d7dd341
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8e95907c0b65/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e95907c0b65f2f882de4d6bf69e0b62bf6ea0be2a87e5cc0ffa535fad492264

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32665/

Comments