snakekeylogger | 2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_elex_glassworm_karagany_marte_njrat_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_elex_glassworm_karagany_marte_njrat_rhadamanthys_smoke-loader_stop
Size 332KB
Sample260703-ln48csew8x
SHA256 ed27063c0309aadece97d349afb376404325000af716b3ba90406e214e9af0e4
MD5 f485352f9184c62ca14a4345b891a061
SHA1 ac648af23b4de0cd9112780731cd21aa0e45f358
SHA512 89081cdcd4c08df7920a22ca33efa8bb647b97aca8b41b0bca05c03734706913ec9adb757bdc1dc1b07b810ec102a5d76e3ad7753d054fe5e8fe1cd04aedfe75
SSDEEP 6144:ISncR43LFIj2bsUNbBNLYdT97JSIFl0QENqF:B4YLFIFUhBNLYdT9FSDQEMF
TLSH
T1F7747C263BF4C834E6FF463205B15225CBBAF8210625CA9F67C0A9591D797C0DD2AF93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat stealer keylogger snakekeylogger infostealer warzonerat

Malware Config

Signatures

Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM

Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Detects executables with potential process hoocking 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_elex_glassworm_karagany_marte_njrat_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_elex_glassworm_karagany_marte_njrat_rhadamanthys_smoke-loader_stop

.exe 332KB

2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_elex_glassworm_karagany_marte_njrat_rhadamanthys_smoke-loader_stop

SHA256 ed27063c0309aadece97d349afb376404325000af716b3ba90406e214e9af0e4
MD5 f485352f9184c62ca14a4345b891a061
SHA1 ac648af23b4de0cd9112780731cd21aa0e45f358
SHA512 89081cdcd4c08df7920a22ca33efa8bb647b97aca8b41b0bca05c03734706913ec9adb757bdc1dc1b07b810ec102a5d76e3ad7753d054fe5e8fe1cd04aedfe75
SSDEEP 6144:ISncR43LFIj2bsUNbBNLYdT97JSIFl0QENqF:B4YLFIFUhBNLYdT9FSDQEMF
TLSH
T1F7747C263BF4C834E6FF463205B15225CBBAF8210625CA9F67C0A9591D797C0DD2AF93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding command execution via IExecuteCommand COM object
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables using Telegram Chat Bot
Detects executables with potential process hoocking
Snake Keylogger payload
Warzone RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths