MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce113e073aa8b0c405170b4f9ba6f422fbf8e56719a2a9bc4e80c0c27a0df178. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce113e073aa8b0c405170b4f9ba6f422fbf8e56719a2a9bc4e80c0c27a0df178
SHA3-384 hash: dff22000091f2a00cfd26ee89ee7c6d6f295008b18102abe70f798581fa252e5b9e70819d2d70051eceea798978a4105
SHA1 hash: aecc93d11885333d596b5e20df398221a1a5cbe5
MD5 hash: 478b6c127c58d123d508bf3b3185696f
humanhash: ack-rugby-dakota-delta
File name:final invoice.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:660'992 bytes
First seen:2025-03-24 12:07:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:NEzMjvOn6nzxSRmNTFukoanGP+IEAk2Gv4f3asfBSwAg1Xz:6Ij2n6n4ENoP6NKamBSAt
Threatray 3'847 similar samples on MalwareBazaar
TLSH T135E4F15857D9C816C6A6673D5530F63863BFAE99A931E3074FDC6CAB7F2BA004D00392
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 70cca2b2b2a2cc70 (7 x Formbook, 7 x SnakeKeylogger, 5 x MassLogger)
Reporter threatcat_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
382
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4365c365d4b84ff2eaaa70241d4bc0ef8841a63aa328725e47a65e714deb8ba9
Verdict:
Malicious activity
Analysis date:
2025-03-24 05:15:19 UTC
Tags:
arch-exec evasion snake keylogger stealer ims-api generic
Link:
https://app.any.run/tasks/aa1b7f94-7345-452c-a818-414fbb5eff97

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Packed2.48976.9228.31266.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67e0ea67bb84e066269e6859
Tags:
snake virus krypt msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67e14c291ccf9586bbc5273c/reports/d41755f0-e603-4b4a-bfa6-17470751bf3e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ce113e073aa8b0c405170b4f9ba6f422fbf8e56719a2a9bc4e80c0c27a0df178
Result
Verdict:
MALICIOUS
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1646982
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ce113e073aa8b0c405170b4f9ba6f422fbf8e56719a2a9bc4e80c0c27a0df178
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce113e073aa8b0c405170b4f9ba6f422fbf8e56719a2a9bc4e80c0c27a0df178/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-03-24 04:02:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
21 of 24 (87.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zyit4bz2vcymibixbnhzxjxuel57rzlhdgrktpcoqdame6qn6f4a._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
404keylogger
Create hunting rule
Similar samples:
068e05c944faf172cf83584b995dd98b6ad77a42df01e0bda06cec52eebc3074
SnakeKeylogger
1f522609abaf12c6647c56b379cdf2c9263a845a6b4c93bac7111d0c27d68159
SnakeKeylogger
7b2118ed1133b43f2521509f4eac9e89b89cdfc389208099cc6e601aaf95c836
SnakeKeylogger
b1bd96341b2c06cf1ea7a1a9026222f1a85d8605798be6f7809100b3e0bd11dc
SnakeKeylogger
b348825be831e3eb48ba5bee71b43e90073ba4d29056c86aea794dd1b6424618
SnakeKeylogger
error
SnakeKeylogger
+ 3'837 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/250324-pce1way1ht/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7939905545:AAGZ8bMeWRWU5UEZdgj90fd6BDk9K4EMabA/sendMessage?chat_id=7000018009
Verdict:
Malicious
Tags:
404keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/c8c4aa92-4eab-4357-8c84-1d3f6c54aa91
Unpacked files
SH256 hash:
ce113e073aa8b0c405170b4f9ba6f422fbf8e56719a2a9bc4e80c0c27a0df178
MD5 hash:
478b6c127c58d123d508bf3b3185696f
SHA1 hash:
aecc93d11885333d596b5e20df398221a1a5cbe5
Link:
https://www.unpac.me/results/0d6587be-9c4a-401e-81fa-e6d5aaf4a5fc/
SH256 hash:
72bfd47266006b378f1b63658456e1fa450b4c8fa93a1e0c484f51261573257a
MD5 hash:
4966311889e08f67f7fa6bae9272372e
SHA1 hash:
6fbbd39bcdcf4891b07bab95d14e20f00ce710ce
Link:
https://www.unpac.me/results/0d6587be-9c4a-401e-81fa-e6d5aaf4a5fc/
SH256 hash:
d0c13afb4ccab72f1e79c38c3be05f8ca4cc931fab29feb2b88b2547c22cf823
MD5 hash:
138baceb4c6295df6b144b5d085b8a99
SHA1 hash:
a0072f86cec73ea05007b1af73dfc99e13297512
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0d6587be-9c4a-401e-81fa-e6d5aaf4a5fc/
SH256 hash:
dcdc467dbd8f6c40eb65ec7d54fd0f260a36a8c656c1dd2b9a7f8091a92500e1
MD5 hash:
5467922ec32071d557191f061e5f3eca
SHA1 hash:
dd18ee16b2cd0afed0935aaaee818dd653a7894d
Detections:
win_404keylogger_g1
Create hunting rule
snake_keylogger
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/0d6587be-9c4a-401e-81fa-e6d5aaf4a5fc/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ce113e073aa8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe ce113e073aa8b0c405170b4f9ba6f422fbf8e56719a2a9bc4e80c0c27a0df178

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments