MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19
SHA3-384 hash: e8eefbd769397ebafacefbb0a78f763d82afb58a686c208b0a6d83dd9a26130d57d096cf33f85c47fadf8614eb8f796e
SHA1 hash: 4b3e050a4f79f15cc81d3678bb0ec5a14f818834
MD5 hash: d5b040e446585cb28cdcc712a37d5012
humanhash: lithium-william-nebraska-nuts
File name:beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:806'912 bytes
First seen:2025-08-12 14:55:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:oNavan464X58wTqI8L5oVRWaK9m31zkxm+P96kuK1RnFWuo2OxRJbfKjccB02Ia:YMKde69Oko+gQnsuotBuIcB
Threatray 3'178 similar samples on MalwareBazaar
TLSH T1DF05F1582BA8D600D9AB1B745971D1780374BE8AB520E35D8FC8BCDF3DB2B844D167A3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19.exe
Verdict:
Malicious activity
Analysis date:
2025-08-12 17:05:22 UTC
Tags:
snake keylogger evasion telegram stealer
Link:
https://app.any.run/tasks/e3cd7d4e-b6b3-437e-8c89-2a4564f48426

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/20875/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.76970080.21334.12403.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b5a6dfca70bd90e8f1f16
Tags:
backdoor virus spam msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ee59c3fe-f609-4267-91b2-5c83812366b2
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19
Gathering data
Gathering data
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19
Threat name:
ByteCode-MSIL.Backdoor.njRAT
Create hunting rule
Status:
Malicious
First seen:
2025-07-30 12:54:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x25cwbpattvmpgszmkp5wojtdkkwios37ip3ivrk45ekacmkd4mq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
45058c52a1b3c9a5755be5783f3ceadec45cf9543e8ce0e2ce353f51cfc92a5b
SnakeKeylogger
4d4f4dd3dd03d3ff63689d10675978b1e232f7d1429eca28cd3d9525824817eb
SnakeKeylogger
73ab8358ef3fd724fc5d5c31d13dfb4717ba6cc254c7da6402d3133c60ce058a
SnakeKeylogger
eb93294abe8d7afffa66b6d07a7dd990849a1a342f2c9096f54105db26592f1f
SnakeKeylogger
+ 3'168 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/250812-vkbajsspx6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
VIPKeylogger
Vipkeylogger family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/07652cc8-9cde-4c31-a13c-58a59033b706
Unpacked files
SH256 hash:
beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19
MD5 hash:
d5b040e446585cb28cdcc712a37d5012
SHA1 hash:
4b3e050a4f79f15cc81d3678bb0ec5a14f818834
Link:
https://www.unpac.me/results/ea0abe84-5f3b-43c0-8a74-c8c34e3d5222/
SH256 hash:
502b0f495556c8e5bd27518cdcf49c5569306941ea58688a1dfdfeeb910ebec9
MD5 hash:
0a49af0d6b22feb8aeb42d1b45c2c0a2
SHA1 hash:
0fa2857c107407d17c8255e499ec3992c5de9c80
Link:
https://www.unpac.me/results/ea0abe84-5f3b-43c0-8a74-c8c34e3d5222/
SH256 hash:
367f6f714a6eea148124d4669325471bb9bbd657920d148bfa7a31bc0646aaf2
MD5 hash:
e9b2ca3db70158f828ec05feeef8d70b
SHA1 hash:
a229a4a959a07f8901b12c38da7ed48c8f57928c
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/ea0abe84-5f3b-43c0-8a74-c8c34e3d5222/
Parent samples :
dca4a0a404c09d7b4da1f2716259b99a158ea835c75dabb9783cccdd0c06a4b2
f1a63402b0f5d6fa912631cb835ab163cf88156bc391fb207af6a143b0162584
bcd2512db9d2789cd0ad058f0c2fd676cf37368174a75a95306f229df5d66dd2
717a837bfdc5f383080ba2ed80fe0fa7fceaac43d33a13f14d0e01ceeaa1ba95
beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19
SH256 hash:
3d977f63078fc20450d867a299f6788c2baa14b1ec54b38699ade527bed721a3
MD5 hash:
17abb08fd3be7119d4eb24c7013491da
SHA1 hash:
b1b728ed96ed0dfd7471d4f465ddb6545f605d43
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/ea0abe84-5f3b-43c0-8a74-c8c34e3d5222/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/beba2b05e09c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/beba2b05e09ceac79a59629fdb39331a95643a5bfa1fb4562ae748a0098a1f19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20875/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments