snakekeylogger | bcd4bfc2384458f038fe3fee51501217d94dee3254f9ae85288225ab1489b35a

General

Target
2026-07-01_963f4e5a1da2a9047e7e4c8d1bcf455e_404-keylogger_amadey_ave-maria_bazarbackdoor_coinminer_darkgate_elex_glassworm_marte_njrat_smoke-loader
Size 352KB
Sample260701-kt1lpacs71
SHA256 bcd4bfc2384458f038fe3fee51501217d94dee3254f9ae85288225ab1489b35a
MD5 963f4e5a1da2a9047e7e4c8d1bcf455e
SHA1 9b69c3bcddc56d12b4304470ea727b13cbe42abc
SHA512 051081533344f368874c2a10b0a33f496013f0ff4876b6e963a3caf68db2793a44df7444c047e9ffe5d13253ea10987efba5a76ea7980636b8189036d9133b41
SSDEEP 6144:AfAnavPdLFIj2bsUNbBNLYdT97JSIFl0QENqF:4P1LFIFUhBNLYdT9FSDQEMF
TLSH
T1F2747C293BF48834E6FF463205B15621CBB9B8210626CE9F67C0A5591D797C0DD3AFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_963f4e5a1da2a9047e7e4c8d1bcf455e_404-keylogger_amadey_ave-maria_bazarbackdoor_coinminer_darkgate_elex_glassworm_marte_njrat_smoke-loader
- Size 352KB
- SHA256 bcd4bfc2384458f038fe3fee51501217d94dee3254f9ae85288225ab1489b35a
- MD5 963f4e5a1da2a9047e7e4c8d1bcf455e
- SHA1 9b69c3bcddc56d12b4304470ea727b13cbe42abc
- SHA512 051081533344f368874c2a10b0a33f496013f0ff4876b6e963a3caf68db2793a44df7444c047e9ffe5d13253ea10987efba5a76ea7980636b8189036d9133b41
- SSDEEP 6144:AfAnavPdLFIj2bsUNbBNLYdT97JSIFl0QENqF:4P1LFIFUhBNLYdT9FSDQEMF
- TLSH
  T1F2747C293BF48834E6FF463205B15621CBB9B8210626CE9F67C0A5591D797C0DD3AFA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery snakekeylogger warzonerat infostealer keylogger rat stealer upx
- Family: Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Family: WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Snake Keylogger payload
- Warzone RAT payload
  rat
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables embedding command execution via IExecuteCommand COM object
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Detects executables using Telegram Chat Bot
- Detects executables with potential process hoocking
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Snake Keylogger

Family: WarzoneRat, AveMaria

Snake Keylogger payload

Warzone RAT payload

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables embedding command execution via IExecuteCommand COM object

Detects executables referencing many email and collaboration clients. Observed in information steale

Detects executables using Telegram Chat Bot

Detects executables with potential process hoocking

UPX dump on OEP (original entry point)

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2