MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
SHA3-384 hash: fe7ba524b1f2c09941936429fcab04b787a722fd3f056d97725f9b631460d800b1f2581ca1da80ac347db4cb782681a3
SHA1 hash: f8d4d27fceb919d28b232690673eefd46eaefcc8
MD5 hash: 0e5615243be67f8a39fb9c91a7a215f5
humanhash: montana-four-double-south
File name:98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:982'536 bytes
First seen:2026-02-05 15:25:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 12288:Jc9y7hqTXIH7dSgxf2fwTesttkWZxYuCcH46GvmNj3sBsDAPGM9QDH6CsFkkR:JeWU82fcHkWZxYun9sBsDAPGM9Qr6VD
Threatray 2'872 similar samples on MalwareBazaar
TLSH T12F251295379DCB22C9D65FF00665D37423B0AEAEF920C3428EEDADE739607062954387
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1a831092-48b7-4c48-94e4-13ebc58dab57/
Malware family:
n/a
ID:
1
File name:
98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
Verdict:
Malicious activity
Analysis date:
2026-02-05 18:37:58 UTC
Tags:
evasion snake keylogger telegram susp-lnk auto-startup stealer smtp
Link:
https://app.any.run/tasks/bd401f90-01d5-434f-a667-79fafc2b43c2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/52030/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6984b680117f8ed80109ca38
Tags:
infosteal spam
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-21T12:36:00Z UTC
Last seen:
2026-01-31T07:41:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/981873a9-ca3a-4b24-b12f-1cf7182a15e6
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc/
Threat name:
ByteCode-MSIL.Spyware.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2026-01-21 14:00:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
25 of 36 (69.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdj5fdmo2xerji56iugwdvtdzur4i32w7rztwx24hwglqlmh5toa._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
5835857507ffd6d949bf2f69e45d965c859ca5791d496e82135ffd9083062bed
SnakeKeylogger
9fb1204c8710eeef8644149f9ab0c670f7eb65ba4ca3465ed5abb7b8c569f1ff
SnakeKeylogger
a0f222db8c40b6284375dc5a7b454a9c6712e670733befa13b5b0805947a82be
SnakeKeylogger
a5e22d2f663271d4197e2fc2dc6cfdbdb7a1daa153b3a19d370c41cb586d200e
SnakeKeylogger
cc0be9f62a9bd5e8568699ba597b1995608b1edc99f79cd2068a2c4ddd5e1b1d
SnakeKeylogger
+ 2'862 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery evasion execution keylogger stealer trojan
Link:
https://tria.ge/reports/260205-stwlqsas8b/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Modifies Windows Defender DisableAntiSpyware settings
VIPKeylogger
Vipkeylogger family
Unpacked files
SH256 hash:
98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
MD5 hash:
0e5615243be67f8a39fb9c91a7a215f5
SHA1 hash:
f8d4d27fceb919d28b232690673eefd46eaefcc8
Link:
https://www.unpac.me/results/a041163b-57c9-41e7-82ab-10dee10bd279/
SH256 hash:
4c1c565207f0075b849c8069918d3acd1561ccbb6f2aef7073d45de6dab29452
MD5 hash:
3d6fd4cfb478847ec5b4e1a18fd7e5ab
SHA1 hash:
6cdf4a9f2139b11944a4333e520315233b67d5df
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/a041163b-57c9-41e7-82ab-10dee10bd279/
Parent samples :
6b76f76b9ed250c6fa30cd2bb8228329829c4fac161dcd1058b7a640bffd2601
60ef1afae839bd774d59f78c2866dad57a397db6f1c3a8432d3daa39985e040c
470ce68595ae8ca768012d0ec974f0099d2bfb4995d6d8547df82c7186752853
98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
13d86cd98fa20c90ce941d9e3088a00abef85faed0695ca7bcf3434a704dd810
269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233
SH256 hash:
12db32c9b2ac0cd7ed4c193de1b166f493bedc91a4b4a97a963d15dce59082a9
MD5 hash:
2b15f677ded05294698c6cedb4418fb7
SHA1 hash:
c1316a961487cbc491944897e262254e7d4e451e
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/a041163b-57c9-41e7-82ab-10dee10bd279/
SH256 hash:
60c7601b9527db8e0676457ed021855357be6eab0592b3c643cf4729ff1f4610
MD5 hash:
a6550d7aa75de8fe1cbeaaa5d4ddb28c
SHA1 hash:
e4b429f76f1daa4d4ea71d449c8bf1c0db9c8837
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Link:
https://www.unpac.me/results/a041163b-57c9-41e7-82ab-10dee10bd279/
Parent samples :
98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
0e1ea2bee6ebd3ca2bbcaa814faaddf1d6dc53bf81e2695a609a8f45ceffda9d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52030/

Comments