MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 18


Intelligence 18 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
SHA3-384 hash: 1556dca5c58108eee5436022d4921f4d8b0d3653a85f5ee516943386985e7d26e036f5ec930ce6d42ddfd0e81e34e474
SHA1 hash: d022e1c0d4ca3b3c6dcf758fb1e9cd4551e0df11
MD5 hash: f139462ea1b7aab2d5864ce989674b59
humanhash: snake-maryland-papa-oxygen
File name:invoice.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:844'800 bytes
First seen:2025-09-09 05:58:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:zPKbmE9BgQIV54bMHW2A4/FqUMpG736ZyHIMWJ2UjRYYwmr0LFXgZte:zPKJ9BgN544HW2lqUM4rnUql/
Threatray 2'747 similar samples on MalwareBazaar
TLSH T19205DF5032A89D0BE0B65AF046B4E2B11BB4BE59B966D2CF8DC13CDF79F5B404682707
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
invoice.exe
Verdict:
Malicious activity
Analysis date:
2025-09-09 06:04:02 UTC
Tags:
snake keylogger evasion telegram stealer
Link:
https://app.any.run/tasks/8f642062-d8e3-4c6e-918b-ddcb92edaf83

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/26412/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.7555.14162.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bfc2476e66ba602d7946ee
Tags:
backdoor spawn spam hype
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68bfc249cfa59bfdc7f4e24a/reports/e2ab158c-fb58-4250-8377-1cc0aeb2e422/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-08T22:42:00Z UTC
Last seen:
2025-09-08T22:42:00Z UTC
Hits:
~1000
Detections:
VHO:Trojan-PSW.Win32.Stealer.gen Trojan.MSIL.Crypt.sb Trojan-PSW.SnakeLogger.HTTP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan-Spy.MSIL.Noon.gen HEUR:Trojan.MSIL.Injector.gen Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb Trojan.Win32.Diztakun.sb
Link:
https://opentip.kaspersky.com/946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32e66fca-6dfc-46bc-9c6b-0f39555824de
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1773703
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Disable Task Manager(disabletaskmgr)
Disables the Windows task manager (taskmgr)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-09-09 05:25:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
40
AV detection:
27 of 38 (71.05%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=srsxr75yxyd3z47fnor2rn3ce3cbe6p6xtapy6xtd4cyc2sy4qka._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
vipkeylogger
Create hunting rule
Similar samples:
2bd14b966dec6792a03cd2925460702e0a83da7d3d4b3461eac8f01c78cc1326
SnakeKeylogger
2f76a21937582bd59783cab01437d029a6ccd52635e2a3f424831ad7e444e640
SnakeKeylogger
6b734c88958bfe7447e6702844486156daf7a54cbd0a1cf9b7bfef98daadf519
SnakeKeylogger
7f2ba58342f429d0e0ee093fc20b52e1b03db43243bf7838561b9b22ef9588e8
SnakeKeylogger
error
SnakeKeylogger
+ 2'737 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection defense_evasion discovery evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/250909-gp15watzf1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Disables Task Manager via registry modification
Modifies Windows Defender DisableAntiSpyware settings
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/7ee02dbb-a18f-479e-b3b9-537422777ce0
Unpacked files
SH256 hash:
946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
MD5 hash:
f139462ea1b7aab2d5864ce989674b59
SHA1 hash:
d022e1c0d4ca3b3c6dcf758fb1e9cd4551e0df11
Link:
https://www.unpac.me/results/3bc952b4-dc62-4765-9dc2-1f2357bf5147/
SH256 hash:
bfd9e784b16c080df91c5019b42a50655c4fefb46bf761f5f19e0b686643c5bb
MD5 hash:
64f04cb0f4a616ad6227723ddec4a13c
SHA1 hash:
12dedd0357cfccb9ef03a62f35b9bf519fe8868a
Link:
https://www.unpac.me/results/3bc952b4-dc62-4765-9dc2-1f2357bf5147/
SH256 hash:
13cb5381ef79e46b1b4ee48c75b8a1a3768c8462183b316137fc51b0d98002f2
MD5 hash:
7c5f93610721117622f488bd8f476e60
SHA1 hash:
90394696ac147dd9d8d0fa1bcae1c93abf8dcf75
Detections:
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Link:
https://www.unpac.me/results/3bc952b4-dc62-4765-9dc2-1f2357bf5147/
Parent samples :
d41022d91ed5c237cbcb1cfaef080005bf5dae114f06418c873596c6c0149a11
f8591a5b43f62cdd88b1e86812b7360ba8e9b41b2780f8df5f276fd4298f4db8
c2f71c006d57414ecfcc0a9718779ae6f19c63ff7ef6738c4a5aa7c38e28d77e
b43a26bba9392c41659ef71c0ba10b4c00d641646c002a64cbe11d09fc4f5cd9
10f246e9a23f84a9e80787e654d3f5612eaded3b992ccaa7a92a94ce8676e40f
ad188854da20c440975e7bf1bfc218c1917da6d7155c77b8c03fefc148ac1759
4ed89812437a80fce23d4c00bafc70da61f00f23f8c0132863385686c2e8a06d
946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414
285f27b7a97e4c9020bf006a45433740310630a75b4af405bb0da8a65232d7ff
67afaa018db220d0df98af446fd9e47ff8f9093cbd17e8c100119a1efb9b2288
SH256 hash:
751ebb24a1590e18b6a221cd32e2ddbcbbb6a259ae54c1433e3b8e2f764472af
MD5 hash:
efd478f813946a67de80ea0974d2e540
SHA1 hash:
b84201fd142eaafd657ed2770c53ff8c43e58f45
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3bc952b4-dc62-4765-9dc2-1f2357bf5147/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/946578ffb8be/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 946578ffb8be07bcf3e56ba3a8b76226c41279febcc0fc7af31f05816a58e414

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/26412/

Comments