MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Intelligence 17 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9
SHA3-384 hash: 934d4ac66ffd9bd7efe6d1d2581a69513dec3128926169c111f8123650572d538e5ed92366fd3b3f388d8d8da1504313
SHA1 hash: 9f3d5acfd3c0f95cea231d234a0725081919aece
MD5 hash: 3f90dc5991ecbf5f43d0dd4bce9f00d7
humanhash: victor-sierra-crazy-robin
File name:SecuriteInfo.com.Heur.10993.6711
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'104'384 bytes
First seen:2025-06-25 13:44:33 UTC
Last seen:2025-07-07 14:59:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b768923437678ce375719e30b21693e (143 x Formbook, 25 x MassLogger, 22 x SnakeKeylogger)
ssdeep 24576:h5EmXFtKaL4/oFe5T9yyXYfP1ijXdazFjyDiseN5FJ:hPVt/LZeJbInQRazFjyus
Threatray 3'615 similar samples on MalwareBazaar
TLSH T1CA35AE0273D1C062FFAB96334B5AF6115BBC79260123A62F13981DB9BD701B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter SecuriteInfoCom
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
417
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Heur.10993.6711
Verdict:
Malicious activity
Analysis date:
2025-06-25 13:45:38 UTC
Tags:
evasion snake keylogger stealer
Link:
https://app.any.run/tasks/93a00d3d-1fe3-48a5-9022-9e754cadb0a8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11098/
Detection(s):
SecuriteInfo.com.Trojan.Inject5.58299.31465.14269.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685bfd90b06783b9ebd762e1
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script entropy fingerprint keylogger microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/685bfd8b3faf8fcd7d41a371/reports/7b5fff7f-749f-40bc-9622-4ef393889b64/overview
Verdict:
Malicious
Labled as:
Trojan.BAT.Agent.gen
Link:
https://www.hybrid-analysis.com/sample/aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cdfc1a47-403c-402c-8743-fa81aaab9e52
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/3f90dc5991ecbf5f43d0dd4bce9f00d7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9
Threat name:
Win32.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-06-25 13:45:45 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vkx66vrg4kiakslsyjwrnwufdaiilbdl5nm3sxgqmzkguyrpq74q._file
Verdict:
malicious
Label(s):
404keylogger
Create hunting rule
Similar samples:
48769d9bf9c85f5285abc8e656352c4956c42e29f86102ff7a57be0a250938b3
SnakeKeylogger
937165f6ec620fd90744f5d180ffdaac029bda7ced16debce856dba23aa60728
SnakeKeylogger
9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010
SnakeKeylogger
aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9
SnakeKeylogger
error
SnakeKeylogger
+ 3'605 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250625-q2r76szlv3/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4ed5e3b4-7461-405f-8f5e-3ece6a2a391e
Unpacked files
SH256 hash:
aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9
MD5 hash:
3f90dc5991ecbf5f43d0dd4bce9f00d7
SHA1 hash:
9f3d5acfd3c0f95cea231d234a0725081919aece
Link:
https://www.unpac.me/results/f7bf8cf2-d866-4e2c-9ef8-f1fb5e9e8d5f/
SH256 hash:
119bfb553c8ce015aefcb78ba53e43f13f0ae180d84b7fda4c23035df9f56b1a
MD5 hash:
670f7eb0a268dddc37c687bbd74b57c4
SHA1 hash:
836c6b21a5ba1b5d2562a13cf15ffd45a862188a
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/f7bf8cf2-d866-4e2c-9ef8-f1fb5e9e8d5f/
Parent samples :
e23c4714e0444abee50475c934b6c662757579031c8bf0451ce2b88f8ada6f68
aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9
5233122e5f93d05501a93cfff2fc135c45448be84f8e321906e8f507a118a897
c271a8e1a4ad55a65962e50f52eb8d8c2bcf87e653ecbe50359dbfe8deda5f38
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aaafef5626e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aaafef5626e290054972c26d16da85181085846beb59b95cd066546a622f87f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11098/

Comments