MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9
SHA3-384 hash: 1100b5688b0402c2e4f0483ef7deff3e8ae139d6fe40e4a177a4137df71f9fe8ac626f41bb89417d3fc3ae99fa126acb
SHA1 hash: d14f5b1c9e0132db7afab2fbaab52b271847ebbc
MD5 hash: 65835b77192abb922abf047e39d8e857
humanhash: sad-cat-minnesota-oregon
File name:cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:564'736 bytes
First seen:2025-11-06 11:40:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:U5xHmqGqS8Fy/Y046gom5LRrbHC6QHieOo:kHmiyAKgbtSHiJo
Threatray 2'057 similar samples on MalwareBazaar
TLSH T1F9C4019523A5CA02D6BAA7B02AB2F57003B87E9EB521C3161FC96EFB7475F005D04B53
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9.exe
Verdict:
Malicious activity
Analysis date:
2025-11-06 11:43:30 UTC
Tags:
snake keylogger evasion stealer
Link:
https://app.any.run/tasks/70529828-b49d-495d-865d-a1f9662de8e0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/36289/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.42087.24800.2314.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c897b5a5ed7864e238209
Tags:
spawn shell virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Adding an exclusion to Microsoft Defender
Forced shutdown of a browser
Gathering data
Verdict:
Malicious
Labled as:
Trojan_MSIL_DarkCloud_ABJB_MTB
Link:
https://www.hybrid-analysis.com/sample/cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-29T07:02:00Z UTC
Last seen:
2025-11-04T18:27:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan-Spy.MSIL.Agent.sb HEUR:Trojan-PSW.MSIL.DarkCloud.gen HEUR:Trojan-PSW.MSIL.Stealer.gen HEUR:Trojan.Win32.Generic Trojan-Spy.MSIL.SnakeLogger.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb
Link:
https://opentip.kaspersky.com/cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9/results?tab=lookup
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.53 Win 32 Exe x86
Link:
https://app.malva.re/file/65835b77192abb922abf047e39d8e857
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9
Threat name:
Win32.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2025-10-29 09:57:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z4fbrusa3r2vryxw5k6tsomv6ufahc7tdyopuat2zmsdmrgahg4q._file
Verdict:
malicious
Label(s):
404keylogger
Create hunting rule
unc_loader_037
Create hunting rule
xworm
Create hunting rule
Similar samples:
2d5dae8b1dedfc3530d6e029d9002235fd4faa83d9b8df3085b65d218254d00f
SnakeKeylogger
42f5cbb12c4e13fb288fa434f31141d11f75f6a886623668d2d10f883dfc912b
SnakeKeylogger
6259efc0951c3a9affca345f2e8ca1eedee205d1b0f1d8b71b5e14c8261a281a
SnakeKeylogger
a822bed7ad8245a218ce6a220b9c02693f499cd4bf42e6daf11557b41f114a9e
SnakeKeylogger
cf960781f1a616c0277102db1d353fd73fa2c1e2642dac9e9a31aa21b8d5854f
SnakeKeylogger
+ 2'047 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery execution keylogger spyware stealer
Link:
https://tria.ge/reports/251106-ns5qss1jhv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8300200519:AAFwv-OCavp7vG5bb9GEtd1hIHWHMJQhELE/sendMessage?chat_id=2052461776
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/58ee7270-d4a3-49f7-b3e9-0065beefe58e
Unpacked files
SH256 hash:
cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9
MD5 hash:
65835b77192abb922abf047e39d8e857
SHA1 hash:
d14f5b1c9e0132db7afab2fbaab52b271847ebbc
Link:
https://www.unpac.me/results/70b338d6-55ac-4763-abd3-db55d7608755/
SH256 hash:
8451277a0e96a0f2c18b3cbf0cf6ee3f663c88f90bef1dca3d2b8e816d4a26f8
MD5 hash:
2e27fb2087a40686630bc932df95c134
SHA1 hash:
3b6155bd7fc8557d246a0c592d12befc4b206635
Detections:
snake_keylogger
Create hunting rule
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
Link:
https://www.unpac.me/results/70b338d6-55ac-4763-abd3-db55d7608755/
Parent samples :
c191c2f9a791def57e4aad9f47adccc7b6d88dac8e339c7c716317bc763fe817
fbebd5cb55e5d95fd899c6b492c9d2520732e8e7690672775045c96c35485bb8
cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9
SH256 hash:
24ba0b7d8bff3651978b344f0fd2dcb6c80814ea546307f8ae261b47b1f9810c
MD5 hash:
4a9b9cc1e8e94526d735cc3039160d0b
SHA1 hash:
a0d378220072a8a672abfacd3a82a7349724941b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/70b338d6-55ac-4763-abd3-db55d7608755/
SH256 hash:
81c878e71a82aa8f4175648d188a1f75acf99cd0b02ef0f48e814fb4f44f0fc0
MD5 hash:
2c401550efe4777b67fa67fb7cecdfbc
SHA1 hash:
e5515434b9685499ad38499f4b59ed8c017b88b4
Link:
https://www.unpac.me/results/70b338d6-55ac-4763-abd3-db55d7608755/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf0a18d240dc7558e2f6eabd393995f50a038bf31e1cfa027acb243644c039b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/36289/

Comments