MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 17

Intelligence 17 IOCs YARA 16 File information Comments

SHA256 hash:	ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e
SHA3-384 hash:	afdc2948e484c215e95041402e39ac0321e9e4d3b0396bc972cd7e0c49fb6ce68347eaf68f0dc79dc308538691fed1bd
SHA1 hash:	4dba34015b707698368c7cb2b4c427a3db77270f
MD5 hash:	0ac62c6cac02bae5e060fee8a6d80ed5
humanhash:	victor-may-nebraska-four
File name:	ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	739'328 bytes
First seen:	2025-08-12 14:43:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:Qm0vB0Rk1FND+fhSgk9f9K+1CTtAnMbodcWQsPlnWCFfiZrbMivl9c+Kt:7wN77VP1CuMEXPninvl9clt
Threatray	3'232 similar samples on MalwareBazaar
TLSH	T1C2F40140A7A5C905F4FA6BB94AB1E134477C7D9AAC30E25D1FC86DABBC26F409C14363
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e

Verdict:

Malicious activity

Analysis date:

2025-08-12 21:32:55 UTC

Tags:

evasion snake keylogger telegram stealer smtp

Link:

https://app.any.run/tasks/bc791f82-c871-4b1b-979d-3c440022312a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/20778/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b56b6c633abe3908e54a9

Tags:

agenttesla spam

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Sending a custom TCP request

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Stealing user critical data

Adding an exclusion to Microsoft Defender

Forced shutdown of a browser

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypt obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/689b6d8aa67ac4b37a4e293f/reports/fdc56e45-358b-4a66-a55a-ee4f041596a1/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bd8277e0-c1ff-4d30-8c22-fc7b3030feca

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e/

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2025-07-29 06:05:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 36 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vwfr2om746ud6eoemz4cm2pm556bhuo4knef3myc37fedvvxgvha._file

Verdict:

malicious

Label(s):

vipkeylogger

unc_loader_037

SnakeKeylogger

305d9600a596e53e188bb33f97ec95ce57d2532d55f670fef47165f477d837b7

SnakeKeylogger

5d112bae8efc523f75ae6067c634101605b6d4c5ee4bf67a264ad15daa419b71

SnakeKeylogger

e8e945d0e6a01338aac7ba7c8b5d19bf4ad27824cd328d833a764d4b24ed7d0c

SnakeKeylogger

+ 3'222 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery execution keylogger spyware stealer

Link:

https://tria.ge/reports/250812-t2pc3aer6y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

VIPKeylogger

Vipkeylogger family

Verdict:

Malicious

Tags:

404Keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/50516d52-e636-49bb-9103-b74c0f77e9f8

Unpacked files

SH256 hash:

ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e

MD5 hash:

0ac62c6cac02bae5e060fee8a6d80ed5

SHA1 hash:

4dba34015b707698368c7cb2b4c427a3db77270f

Link:

https://www.unpac.me/results/c84ad6b9-42af-41ba-8ba1-99dc1dfe1cb2/

SH256 hash:

7ee85b0c559e991340849e7aed14e6b39c528e3570f88cafd54ed0cb514dc54a

MD5 hash:

14513eb90b568c82eb5ee25e30b7376d

SHA1 hash:

4e5503c7240cb40ed34d98ef5449fb9079853e27

Detections:

win_404keylogger_g1

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/c84ad6b9-42af-41ba-8ba1-99dc1dfe1cb2/

Parent samples :

544fa321969a10c456ceb6429b96f24ddc64a5ee9b220646083ed3e9d0b5badd
ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e
9957870d8b4fb238246540cf95e7c1b0a3a5d1ddb4d94628c4d6c11be9c7503e
3f1e1bc2b3ac94cbb03ff9942c8753b0a6ea0ce3e6b682727fb013ee873c3d04
26a2714342c817548962d1a9cf5ebb1aacb811c3060fea1269c8280047b8eddf
af3c9677ddb4f4989eefa3f4dbc7c2c61067adfde4203b106939e13def66ba22
5f661d7ab85b73c7ee470cda8fff5192b97d7f25132639adf26a6b2e77f0366d
e66437f20ac2fe570ad886d485354b997e873b9b7eb2ed2db00855e1b09f5e39
2398de60109f8d779ea501e83aef9d119cd05980b0c892514bf8e09d40b4e50d
47c0fc880c110b1df4895e9850fe358aa7e2464878f8e029eb4a51c868a4e92b
362f141bda759af6502f936adf999c6cf54fdc8d1951e103936ece788c3e0139
ae49e785cbda6ce29bcdd3f612351ca1ad9aa053c7cf784a60a3782b89a59108
fb9d538702d3455339c0388fdb21673a75e08710a4f1bd3bdd3d2f06a028065f
3acabc206916e37f01effd69271b72692cb07df3c1f94bf5d3db1aa688284210
e0b4de8edbfab9c43be6369f3a1ec256e417d76f5358c2846126bb1fc43eafcf
d7126aecb21ac24caf1637c63b1c33807da1aaeff976a77410fb1ab40ba96f9a

SH256 hash:

82d2bc76104fb4a7a90e2aded3e0e15e41e05e06bd9fef4126919c4b2da425ec

MD5 hash:

c2cc79e16bda13ce0992b893ae1db3b8

SHA1 hash:

9494e34262ac9fb9ed22b1f75fb4f978db3a5005

Link:

https://www.unpac.me/results/c84ad6b9-42af-41ba-8ba1-99dc1dfe1cb2/

SH256 hash:

3bcd9e7d905dbb908d9409c7bb17d4d39792158c7ab153df5c17406f6a178d0c

MD5 hash:

4f866fe81e9f4ad13b27ef376f561d55

SHA1 hash:

e82ebdbae3fd1498c0d0bc0347dc8a70c2cab0de

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/c84ad6b9-42af-41ba-8ba1-99dc1dfe1cb2/

Malware family:

VIPKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ad8b1d399fe7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ad8b1d399fe7a83f11c466782669ecef7c13d1dc53485db302dfca41d6b7354e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20778/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample