MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456
SHA3-384 hash: 07a3407d7197bafc5ce664eafa65e6b23308ed93728c01ab3c9a6aa6b09ddf90474bdf0e300f87dcb8a33bf5234c2fb5
SHA1 hash: 700181e79ccf22739eb0d1f553c08470e47e5a13
MD5 hash: 31cb1bad9f6336af5eaed432a7b87889
humanhash: mockingbird-kentucky-twelve-cardinal
File name:Підпис першого розділу 00112126_20 СІЧЕНЬ 2026_600_UA docx.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:980'480 bytes
First seen:2026-01-26 08:39:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'656 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 24576:GJioY+FgSkb1W2ZY1iaaj5Ojc/ui1B6sR/cH30:Ggo55kb1W2Zl9j5OI/BD6sR
Threatray 2'869 similar samples on MalwareBazaar
TLSH T18725125427DAD647E9F20BF10C61E33A07B4BE99F411D20A4EEEACDB3870B41A954793
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/bd2363cf-25ec-4df3-832a-1e1146681358/
Malware family:
n/a
ID:
1
File name:
Підпис першого розділу 00112126_20 СІЧЕНЬ 2026_600_UA docx.exe
Verdict:
No threats detected
Analysis date:
2026-01-26 08:52:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c3755de5-0eb5-4604-8c7c-989efb04ec16

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/50190/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69772a5e6fa3eed1652f0a4d
Tags:
underscore dropper virus msil
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-20T03:54:00Z UTC
Last seen:
2026-01-26T19:51:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/221d579e-168f-4c29-8d3d-de826342dfeb
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456/
Threat name:
ByteCode-MSIL.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2026-01-20 12:16:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
25 of 36 (69.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lnhdes34pkt53uwcud4wq54f3satvago4gh3w37f4dk7lufurla._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
0443e508c14630fca81d33c7a33555a32cc35226ebd95d10e361a22fa3beed2a
SnakeKeylogger
3d0dc5e78a43a3651e144c2eb3b05b1268580895b2458b2a8bee4779189d6203
SnakeKeylogger
bd56409ae9a40192097a1b4604f95dbe2ba3c4bf3c1c89bef031c4866300f1f6
SnakeKeylogger
+ 2'859 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/260126-km19mshv5c/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Unpacked files
SH256 hash:
7401f3c388c84e51e6f09c11e53414ac6dfb68b3e2c06c0c73175f6737273243
MD5 hash:
47f0c5721942255b6484dd331502dc6a
SHA1 hash:
6a3f748d0469ca1eacb4f6e0daaa28d220223ebe
Detections:
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/b2964d91-e1ea-4cd8-86c4-86b38680106d/
Parent samples :
a3c7847164f2c9a18c8c6bed01241b84fffbd6d866195e92f556ba0a596d0428
fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456
SH256 hash:
9b17c3a11699df1015715e46440991e6477f32d702f95cc4abe77bbd99fa0c0a
MD5 hash:
cf9e612f09c7a16d9740dabc6aaa0fe3
SHA1 hash:
8942cce9775668300b20ff94d46a872e0cf19e8e
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b2964d91-e1ea-4cd8-86c4-86b38680106d/
SH256 hash:
d4c5416bc2a5af3b1774ff39cb97559b60e9637b65e202e9d35cf1693f3ce471
MD5 hash:
6767996995d8a605a650adfb85503744
SHA1 hash:
b94096e4454ad8f0279c329b5a00a4578363d8d8
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/b2964d91-e1ea-4cd8-86c4-86b38680106d/
Parent samples :
c6aa56afa7a6941d9bb8786b07e192ea996d3a133c992285b58349cc5c204561
bf46723d199408eb636dfbb7d50ef97fad7c96be7aedca35fa350c92a7492a4e
44ece3fd771b241e7adb7b8a46317aa0dce39aa4b815912805de4dc6ff631ae4
5f947957f8b2c4cc8609167eaec826c9855e15c55dac3926c33b2a0c003cf773
a803802107f3ee132802204825112c350470951b753d8b48fc17883ddf25e4a5
a3c7847164f2c9a18c8c6bed01241b84fffbd6d866195e92f556ba0a596d0428
5c0bdefeb2e965c9cb1aa42e28b84b31e11693b4438c47e97be98fb1b496d940
6a6af729bcfe6c368c81300a7b3f078b6077b365d7dad49b9c0bc4d1ee3f71b2
fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456
SH256 hash:
fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456
MD5 hash:
31cb1bad9f6336af5eaed432a7b87889
SHA1 hash:
700181e79ccf22739eb0d1f553c08470e47e5a13
Link:
https://www.unpac.me/results/b2964d91-e1ea-4cd8-86c4-86b38680106d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe fada71925be3d53eee961507cb43bc2ee409d406770c7ddb7f2f06afae85a456

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/50190/

Comments