MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0
SHA3-384 hash: db0b687f9d5bb96d850fb353c14136e22f2665bcf9879e024a9484bff1c9538ca5d03c873b13eb77615d7f3f61ec1f59
SHA1 hash: 460ca530d8a85a0390480e4d70c9906c30c648e5
MD5 hash: 3ae850063d4849d019715209c4672cc6
humanhash: thirteen-kilo-virginia-vegan
File name:a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:844'800 bytes
First seen:2026-06-08 10:02:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'016 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:cev6tcBvx6XkykwBgoPNYamURtVoZ7dt:VS1XfdDDi7
TLSH T1E40512646F48CA03D8D323B80EA1F276A3B88DCDEA15C3165FE9ACEB79797604445353
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4bf2c294-0d16-4bea-9dc6-4c2163ea2401/
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70035/
Detection(s):
SecuriteInfo.com.Trojan.Siggen32.43377.11514.9856.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a269442ae2f98c00a68d0a6
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook infostealer krypt packed similar-threat
Link:
https://www.filescan.io/uploads/6a26946b1f652d68656df12b/reports/127b1ef0-9727-4611-9bb8-4835082f6285/overview
Verdict:
Malicious
Labled as:
Malware.Generic
Link:
https://www.hybrid-analysis.com/sample/a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-20T10:50:00Z UTC
Last seen:
2026-06-10T08:44:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/34df5b48-f828-49ba-8b69-cf8ac60bc8d5
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-05-20 15:03:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
26 of 36 (72.22%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
404keylogger
Create hunting rule
Similar samples:
error
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/260608-l5g46acx6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Family: Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot8957099200:AAF3BANEvLpArvUlsoD52zd3quY_IDGV9mE/sendMessage?chat_id=8547707302
Unpacked files
SH256 hash:
a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0
MD5 hash:
3ae850063d4849d019715209c4672cc6
SHA1 hash:
460ca530d8a85a0390480e4d70c9906c30c648e5
Link:
https://www.unpac.me/results/779e8731-868a-41c3-82ab-8e8890b62b9b/
SH256 hash:
afb928ab123df53cc064f9e365aa2666cd998fa6ddd8ecbdde618ef1c2e13b18
MD5 hash:
dceedc5f7e5668de4771b236a84cffa9
SHA1 hash:
8608b472b2c4ae1d00d69dc1cd4572d8fe68a75f
Link:
https://www.unpac.me/results/779e8731-868a-41c3-82ab-8e8890b62b9b/
SH256 hash:
32ba68904874cb474fa612f63d887d7b685ed5a17eca2205a5cfb9986c4275e4
MD5 hash:
81d0ff0800110e7836f6ba654e00e7ce
SHA1 hash:
8a0dc42e7645dd84b2af6d302f9e61422263336b
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/779e8731-868a-41c3-82ab-8e8890b62b9b/
Parent samples :
d6c16e5772a955424ee442d3e02d6b849e230529ae74985b0582c38b73b81a6c
a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0
ce0e09e88dd736d27d27e6df4ac4124971e9500319d2042f44489a66780afcb9
SH256 hash:
7e5e42651838afcb21918d7c4cec7d2a3352a51bd32f572a8a889e47cedb7c89
MD5 hash:
bc5c24037c01c45d357e78aae1457f88
SHA1 hash:
8b6115e53004c4330550467a4d67c509dc98452b
Link:
https://www.unpac.me/results/779e8731-868a-41c3-82ab-8e8890b62b9b/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a9de89f09732/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/70035/

Comments