MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Intelligence 17 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882
SHA3-384 hash: 00dbbeed947e642136010619ea7b33aaf6017e1e7ea147bca3bbbffb70d052cc25abb991e312ba199f08a03162c8edd8
SHA1 hash: a687f253ecf2e5f82dba73c198c1dc4f436b8588
MD5 hash: 0c055a6c37a3bcac283e9aa8815e1e01
humanhash: victor-failed-hydrogen-lactose
File name:Comprobante_de_pago_-_Banco_BBVA-344556566.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'027'584 bytes
First seen:2026-07-24 12:19:30 UTC
Last seen:2026-07-24 12:35:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'125 x AgentTesla, 20'138 x Formbook, 12'362 x SnakeKeylogger)
ssdeep 24576:HNj/Og3bwAg16+K+Mv8svRqBRYCpwkalXrSrKhkg3B:NPLng1JtYCWlmu33B
TLSH T1372512A473E8EB09C9B487B01A71E1310775AC2EA931E3464DDABCCFB975F054AA0753
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TomU
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
170
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/736508e2-bd1c-4df8-a251-3395876b129f/
Malware family:
n/a
ID:
1
File name:
Snakekey logger.exe
Verdict:
Malicious activity
Analysis date:
2026-07-24 14:22:16 UTC
Tags:
ip-check evasion telegram stealer keylogger snake spyware smtp
Link:
https://app.any.run/tasks/75e9b086-31f6-409c-a8c2-9d9044c19be0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75941/
Detection(s):
SecuriteInfo.com.Trojan.Siggen33.928.11193.22634.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 krypt obfuscated packed
Link:
https://www.filescan.io/uploads/6a6359382f425c61aabddc4b/reports/cce2dae1-1cff-472f-bcab-b18397b746fa/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-20T05:59:00Z UTC
Last seen:
2026-07-26T04:52:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6e617e54-25bd-4122-8674-0a30e475d2c1
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1947694
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected malicious Powershell script
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AntiVM3
Yara detected Powershell decode and execute
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected UAC Bypass using CMSTP
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1947694 Sample: Snakekey logger.exe Startdate: 24/07/2026 Architecture: WINDOWS Score: 100 39 reallyfreegeoip.org 2->39 41 api.telegram.org 2->41 43 3 other IPs or domains 2->43 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 61 19 other signatures 2->61 8 Snakekey logger.exe 1 7 2->8         started        12 powershell.exe 19 2->12         started        signatures3 57 Tries to detect the country of the analysis system (by using the IP) 39->57 59 Uses the Telegram API (likely for C&C communication) 41->59 process4 file5 31 C:\Users\user\AppData\...\FrQlwoAxzC.exe, PE32 8->31 dropped 33 C:\Users\...\FrQlwoAxzC.exe:Zone.Identifier, ASCII 8->33 dropped 35 C:\Users\user\AppData\...\wlp0hzywrur.ps1, ASCII 8->35 dropped 37 C:\Users\user\...\Snakekey logger.exe.log, ASCII 8->37 dropped 63 Creates autostart registry keys with suspicious values (likely registry only malware) 8->63 65 Creates an autostart registry key pointing to binary in C:\Windows 8->65 67 Adds a directory exclusion to Windows Defender 8->67 69 Injects a PE file into a foreign processes 8->69 14 Snakekey logger.exe 15 2 8->14         started        18 powershell.exe 23 8->18         started        20 FrQlwoAxzC.exe 5 12->20         started        23 conhost.exe 12->23         started        signatures6 process7 dnsIp8 45 mail.grupoproindex.com 185.23.69.83, 49772, 587 AXARNET-ASES Spain 14->45 47 api.telegram.org 149.154.166.110, 443, 49771 TELEGRAMVG United Kingdom 14->47 49 2 other IPs or domains 14->49 71 Tries to steal Mail credentials (via file / registry access) 14->71 73 Tries to harvest and steal browser information (history, passwords, etc) 14->73 75 Loading BitLocker PowerShell Module 18->75 25 conhost.exe 18->25         started        29 C:\Windows\Temp\ofywdjic.inf, Windows 20->29 dropped 77 Antivirus detection for dropped file 20->77 79 Multi AV Scanner detection for dropped file 20->79 27 cmstp.exe 20->27         started        file9 signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.53 Win 32 Exe x86
Link:
https://app.malva.re/file/0c055a6c37a3bcac283e9aa8815e1e01
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-07-20 09:01:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfierfl3gdzbafzavpop6i5bprjk2njedxg2f7fpvmzxmak65cba._file
Verdict:
malicious
Label(s):
VIPKeylogger
Create hunting rule
Link:
https://reports.threatray.com/177956bd-4d8c-42a2-b93e-b96a925970ea
Similar samples:
105805695ed39400d28a06af3c31603941ed28c917b1e2601c0b6ee09cbf3037
SnakeKeylogger
71b2457ddc24360563eb07fe7fac84203c695dcf726d1a1f91028b86f2b9a232
SnakeKeylogger
c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882
SnakeKeylogger
dcaeccf5a7ac997efe13a9ad9660fb1defa37bfd85f551679a4b06d611f1cec3
SnakeKeylogger
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery evasion execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260724-phktbayvhw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: VIPKeylogger
Modifies Windows Defender DisableAntiSpyware settings
Unpacked files
SH256 hash:
c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882
MD5 hash:
0c055a6c37a3bcac283e9aa8815e1e01
SHA1 hash:
a687f253ecf2e5f82dba73c198c1dc4f436b8588
Link:
https://www.unpac.me/results/cc808cdb-746c-4b26-b89d-8ea46c46244d/
SH256 hash:
3937b6492f47b4eca5d265253bc9855ef276c0d0b21a68f837e83a57e00aca5c
MD5 hash:
2e76503f1f4c3f5cacaf512b262681ae
SHA1 hash:
007bd160d065c752a8e9d68abd4a91fb753f9dcc
Detections:
win_404keylogger_g1
Create hunting rule
triage_snakekeylogger_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/cc808cdb-746c-4b26-b89d-8ea46c46244d/
SH256 hash:
01ff3e706f0f3928207b5e020eebb9ed38428dfbbf0f8c46aeec328b73519160
MD5 hash:
bbb0d2ca9a21d5a1f6c9059e108ea3ee
SHA1 hash:
5accd45f4a70a26b6ce07e04cc3820e99187a818
Link:
https://www.unpac.me/results/cc808cdb-746c-4b26-b89d-8ea46c46244d/
SH256 hash:
94af68fa02eb6197ccdf732610cb6ebb7416a7809e973a79ad141f75c9299ef8
MD5 hash:
1dd9377baa4ff5b4e0f401f40cb6ed4d
SHA1 hash:
c6e26c69958bd42c0c0622e4dc93a938e805ae7f
Link:
https://www.unpac.me/results/cc808cdb-746c-4b26-b89d-8ea46c46244d/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c95048957b30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/75941/

Comments