MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e
SHA3-384 hash: ad46571cb189c1dbeb7aa5ddd037060935f8bde52b8835b4072bc5c7e7436367e787b01459b2983076ab6dc3cd389709
SHA1 hash: f17f6c33f87c37b6080f686834deb2cef504c269
MD5 hash: 3f5850ff6d3dfa5e3c165d7f6b0ce682
humanhash: pennsylvania-triple-two-missouri
File name:SecuriteInfo.com.Trojan.PackedNET.3357.23912.1738
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:781'312 bytes
First seen:2025-07-01 03:29:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:VJ+ivMeX6nT+VMSkYdboV1U31x7eHZLUV1TqQSY/UJOXigN1O0r3U7Y5e5M6VkgL:BkALdE6Fx6JUGQrxqYM5De98um/
Threatray 3'295 similar samples on MalwareBazaar
TLSH T184F412862AC99F13D6BB0BF51110D0B453755ECE7822D20FAFCAADEBBD56B102601793
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
604
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.PackedNET.3357.23912.1738.exe
Verdict:
Malicious activity
Analysis date:
2025-07-01 03:33:08 UTC
Tags:
netreactor evasion snake keylogger telegram stealer
Link:
https://app.any.run/tasks/60e5faf5-31fd-45a0-8d5b-9f473e3657f3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/11736/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3357.23912.1738.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6863565a37c34367794812c2
Tags:
virus micro spam msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Forced shutdown of a browser
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
entropy obfuscated packed packed vbnet
Link:
https://www.filescan.io/uploads/68635658ee5b1c8f3d221494/reports/98f2fbfe-dccf-4d91-8e91-2d9f065e58f5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/13b3f078-d3ba-412f-b38c-88cb2f41759f
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/3f5850ff6d3dfa5e3c165d7f6b0ce682
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e
Threat name:
ByteCode-MSIL.Backdoor.njRAT
Create hunting rule
Status:
Malicious
First seen:
2025-07-01 02:47:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2fxgghd3k7ylec7hwutooe7staakye5wq2koahztcnve7lteh57a._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
222b82fce8836c7ff44f7eac9a0767bf8cd60a14d22d3d70498a2a1c405aa8be
SnakeKeylogger
a45596db810e56d8ba49f6331c07e63d724795859bc1763323df551bfa7d7c52
SnakeKeylogger
d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e
SnakeKeylogger
db1ac4c87efc64076e9cf93ec1581f73feea43ce6fdb7113101cf287a5968e80
SnakeKeylogger
ec1b776abc39b4aa04715898f4f87054d73c9f6b186151390d7c16da234dae43
SnakeKeylogger
error
SnakeKeylogger
+ 3'285 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/250701-d2qm5azxgy/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks installed software on the system
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
VIPKeylogger
Vipkeylogger family
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/87fc75e6-723a-467b-8ca6-88cedfb69493
Unpacked files
SH256 hash:
d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e
MD5 hash:
3f5850ff6d3dfa5e3c165d7f6b0ce682
SHA1 hash:
f17f6c33f87c37b6080f686834deb2cef504c269
Link:
https://www.unpac.me/results/1af8b5b7-abcb-432a-bca9-4cfd5b7e64fa/
SH256 hash:
7ebfba3fdcf4d0d5e8ecd0445a23dfc046da4b2e4d48bab6473814dcf199ee45
MD5 hash:
9a18eb425213582f8674e26abf5a57fd
SHA1 hash:
0985b8c659415f880c159fc66a16ae75c9345fd6
Link:
https://www.unpac.me/results/1af8b5b7-abcb-432a-bca9-4cfd5b7e64fa/
SH256 hash:
cc2981f809fa134732450f0e9b284a5ad9d80d6c4694e39361175d37ef055a26
MD5 hash:
4c25e50ebf266c9b21f2eb5b56f89171
SHA1 hash:
659d037fdd89b0cd5eeeab02cc9686f401466400
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/1af8b5b7-abcb-432a-bca9-4cfd5b7e64fa/
SH256 hash:
5da32263d2bd300982cd88ca6d94af2d2a0655e1d9df272d7a89871b59e2890d
MD5 hash:
b64e79cff0a19fe83d5c4d768036c1d8
SHA1 hash:
dfe916bd3c92ea1fea90a67ba55b726f8e7c87e0
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/1af8b5b7-abcb-432a-bca9-4cfd5b7e64fa/
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d16e631c7b57/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d16e631c7b57f0b20be7b526e713f29800ac13b68694e01f33136a4fae643f7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11736/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments