MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 19

Intelligence 19 IOCs YARA 6 File information Comments

SHA256 hash:	91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2
SHA3-384 hash:	bdad8304ae6a930b795cf4fa682a8e4da2982d640b11eccb463869c6eb7ca724ade7f558de916c2494b3d7e601f89517
SHA1 hash:	2a8e13e3d7e03d2e2defaccb36a543d2bdf9e3f7
MD5 hash:	8a4de4e21f3a0cad442d0dc90f8c3d3f
humanhash:	venus-triple-fruit-five
File name:	2cdd6fb6cace668f883a8e0134248e484d9a3504bf60b53c7f55fad5ec6eb866
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	1'030'144 bytes
First seen:	2025-11-06 10:56:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c1ce208b1192bfcf652c179f34f034d3 (17 x Formbook, 4 x AgentTesla, 3 x RedLineStealer)
ssdeep	24576:b5EmXFtKaL4/oFe5T9yyXYfP1MAXDzt3K9O:bPVt/LZeJbInGizta
Threatray	1'558 similar samples on MalwareBazaar
TLSH	T12D259E0273C1C062FFAB92734F5AF6115BBC79260123A62F13981D7AB9705B1563E7A3
TrID	50.4% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 19.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.5% (.EXE) Win32 Executable (generic) (4504/4/1) 3.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe SnakeKeylogger upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 2cdd6fb6cace668f883a8e0134248e484d9a3504bf60b53c7f55fad5ec6eb866

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	523'776 bytes
File size (de-compressed) :	1'030'144 bytes
Format:	win32/pe
Packed file:	2cdd6fb6cace668f883a8e0134248e484d9a3504bf60b53c7f55fad5ec6eb866

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

2cdd6fb6cace668f883a8e0134248e484d9a3504bf60b53c7f55fad5ec6eb866

Verdict:

Malicious activity

Analysis date:

2025-11-06 16:41:27 UTC

Tags:

snake keylogger evasion auto-startup stealer autoit

Link:

https://app.any.run/tasks/b2ce3c15-7420-4e79-91bd-d262276436d9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/35950/

Detection(s):

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

PUA.Win.Packer.Embedpe-3

PUA.Win.Packer.AcprotectUltraprotect-1

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690c7f1bea0f3e915c2386d9

Tags:

autorun autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Creating a window

Stealing user critical data

Enabling autorun by creating a file

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-06T09:10:00Z UTC

Last seen:

2025-11-06T10:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2/results?tab=lookup

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e3f8f712-aa1c-4ece-a663-9e32d8366fad

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1809185

Signature

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Binary is likely a compiled AutoIt script file

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Drops VBS files to the startup folder

Found API chain indicative of sandbox detection

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2

Verdict:

Malware

YARA:

6 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/8a4de4e21f3a0cad442d0dc90f8c3d3f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-11-06 10:57:15 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=shzwi4t4kuk2g72iucy2t2yhqlxvzuxx2kwut4pujpvl5j2qrhja._file

Verdict:

malicious

Label(s):

404keylogger

SnakeKeylogger

60935340a8e15bd11c18985a23267dbe3f2576de3cb4d0cb118f8815e45746e3

SnakeKeylogger

624fe4205bb4581a794e454cdcb181f3d5affd7ee3e452db13c0773dda65ba6a

SnakeKeylogger

91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2

SnakeKeylogger

bbeb60069be1fdb21ef420628bb1294bcdac1441d29cf3c91cbc2dfd7e7e07c1

SnakeKeylogger

error

SnakeKeylogger

+ 1'548 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection discovery keylogger stealer

Link:

https://tria.ge/reports/251106-m2cwpsak8z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Verdict:

Malicious

Tags:

404Keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/70b4425e-bc20-4af5-8e68-ba1763f6b127

Unpacked files

SH256 hash:

91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2

MD5 hash:

8a4de4e21f3a0cad442d0dc90f8c3d3f

SHA1 hash:

2a8e13e3d7e03d2e2defaccb36a543d2bdf9e3f7

Link:

https://www.unpac.me/results/ee19e2a1-b228-42ed-a8b7-b8b12190b6a3/

SH256 hash:

ab074c17469c78b73adabc252b28e58f94d33b35cea7d3c4cba735a4d625a457

MD5 hash:

8eaa8a9fee469ebc5b4552a148d67d19

SHA1 hash:

c20c781989f22a2e2c1f73c3e6e1b37d8190af00

Detections:

win_404keylogger_g1

win_masslogger_w0

snake_keylogger

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

MALWARE_Win_SnakeKeylogger

Link:

https://www.unpac.me/results/ee19e2a1-b228-42ed-a8b7-b8b12190b6a3/

Parent samples :

ed9e2702e14b07eeafe408ab9d66d39abb1700e2f6cf4c175db48d741bd19cf8
b50a00929e501313e1973833528b15251bdc410bf43f0328617af7c702096ad8
b7d078fa73d4a05c8216beddcb32493375d8457879525e026712e2a3e5198d89
cf960781f1a616c0277102db1d353fd73fa2c1e2642dac9e9a31aa21b8d5854f
42f5cbb12c4e13fb288fa434f31141d11f75f6a886623668d2d10f883dfc912b
4af374bbae171062a58c22a6a310fdeb2da768cf2bee3bceb8e7677a51c150fa
66fb500e98e755b7ec119c1e9477621ff55e1f08bcca1361c500cb3966d0fb6b
61f18c9b35079e3e414ea5d991e5bc8c1d408941584173d7e4d6d89721ff2d5d
2cdd6fb6cace668f883a8e0134248e484d9a3504bf60b53c7f55fad5ec6eb866
91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2
ef191e2d10681d7e07d403c5a0f5c595fb55c54c9a66ddd6cabdb7af0d6f65b2
d8becc9e6e2f778b79f2fbc7de9d7a922aeab696ba2a799fbcf9ed1267a171d1

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/91f364727c55/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/91f364727c5515a37f48a0b1a9eb0782ef5cd2f7d2ad49f1f44beabea75089d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/