MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 16

Intelligence 16 IOCs YARA 22 File information Comments

SHA256 hash:	bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be
SHA3-384 hash:	3da51098e54faf4acd915e57831244b1ac5715db5122b816d804c0449b70424e5e9dafaf02f78786b757fd61a937f49e
SHA1 hash:	8694b4d04e1a3e60be3d6477606a7e0151a5a42c
MD5 hash:	61f9426a8047db9bd98c7ad5402e615f
humanhash:	white-nevada-fourteen-batman
File name:	bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	725'504 bytes
First seen:	2026-02-05 14:56:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'692 x Formbook, 12'274 x SnakeKeylogger)
ssdeep	12288:dEA4ctN7IBWXWWa/35BpQrcD+CzBpbkMGzDMoM8RkSHPbY+2Hzq1Jwk7Kzs:LTrI7BcYKCIMKMoMykSHTY9zqbwk7Kz
Threatray	2'819 similar samples on MalwareBazaar
TLSH	T1E7F40104225AD903C1D24FB6B971E3B03B389EDBA9A1E2936FC93FDF70366944951346
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/57a80634-1556-4d35-a16a-f1ec8c1603c6/

Malware family:

n/a

ID:

File name:

bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be

Verdict:

Malicious activity

Analysis date:

2026-02-05 14:59:17 UTC

Tags:

snake keylogger telegram smtp stealer evasion

Link:

https://app.any.run/tasks/142b6ce8-1b6b-4abf-b899-102751ab47b8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

VIPKeyLogger

Link:

https://www.capesandbox.com/analysis/51829/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6984afd4ae5379bb6609bd9f

Tags:

keylog virus spam msil

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-01-07T03:53:00Z UTC

Last seen:

2026-02-03T08:40:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be/results?tab=lookup

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8bc53501-cc14-445a-998f-7a6afacbcb29

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.51 Win 32 Exe x86

Link:

https://app.malva.re/file/61f9426a8047db9bd98c7ad5402e615f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2026-01-07 07:00:03 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xth423idh4frbqbkadhca7mzpjxdou2hcw2blnajg4ku2uo4i67a._file

Verdict:

malicious

Label(s):

vipkeylogger

SnakeKeylogger

a9748173bb602313b8b1fc6eb71d4036ad98ba25c19b360326dd74cfd71c6522

SnakeKeylogger

b5b7485b8d9579167eea5ff7728aa336974563a033e602ce35da0eadcd194bb3

SnakeKeylogger

bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be

SnakeKeylogger

c1ac4217e48ba5dcd89a543db47563a12b7e402193145d7d71ae7b3351cad47b

SnakeKeylogger

error

SnakeKeylogger

+ 2'809 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery evasion keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260205-sbrj3agt9e/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Modifies Windows Defender DisableAntiSpyware settings

VIPKeylogger

Vipkeylogger family

Unpacked files

SH256 hash:

bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be

MD5 hash:

61f9426a8047db9bd98c7ad5402e615f

SHA1 hash:

8694b4d04e1a3e60be3d6477606a7e0151a5a42c

Link:

https://www.unpac.me/results/a7c6178d-21f7-4d21-8b38-7b141143a7af/

SH256 hash:

d02dd5a8aa804e5cdde78684e4d40bba17c0ec143503e9ea5cbe2b27a95a8117

MD5 hash:

c191b61cebdd664beb166c164560d845

SHA1 hash:

195f6b1a213f9b03f1ada616a516924e4aa926d0

Link:

https://www.unpac.me/results/a7c6178d-21f7-4d21-8b38-7b141143a7af/

SH256 hash:

b8ce03f21471763001f12b9021cb87117c19544c72eef96b0ace14991a421d23

MD5 hash:

971732eaa9f538b1c5d5e4c9ca63670e

SHA1 hash:

a561b9008f28d17db96a5191b568bdd758247e4d

Detections:

win_404keylogger_g1

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Link:

https://www.unpac.me/results/a7c6178d-21f7-4d21-8b38-7b141143a7af/

SH256 hash:

479424c9c7472b717fc09e521c2bab0ed9493993469b04e1c24a3997e6acadb2

MD5 hash:

5f176aaffc6d045213a7ee41c079b43c

SHA1 hash:

d8d4cc928b852b2f044acd2ffe1c8d884c3b17b1

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/a7c6178d-21f7-4d21-8b38-7b141143a7af/

Malware family:

VIPKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bccfcd6d033f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bccfcd6d033f0b10c02a00ce207d997a6e37534715b415b40937154d51dc47be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TelegramAPIMalware_PowerShell_EXE Create hunting rule
Author:	@polygonben
Description:	Hunting for pwsh malware using Telegram for C2

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	VIPKeyLogger Create hunting rule
Author:	kevoreilly
Description:	Detects VIPKeyLogger Keylogger

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/51829/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample