MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 008a18d1c20cb7b7bf26846bafe486b277c90bbb0cc7d1380645513818f5041c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 008a18d1c20cb7b7bf26846bafe486b277c90bbb0cc7d1380645513818f5041c
SHA3-384 hash: ac096346b9e0a5ddcc2f60fdc1dcecd8861c8139124d108dc82e9ae926c77e49c0374a95163c01f3e5bd9a9b7a4eb5e5
SHA1 hash: 98332ba6ff6b3a8b1eb96f5e7cae4d545b24c3af
MD5 hash: 87ca07e743d3730635842f25ec99398d
humanhash: mississippi-arkansas-connecticut-three
File name:New.Purchase-Order2023.scr
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:412'160 bytes
First seen:2023-03-22 15:56:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:tvc59sL+VFWtlEtxbdzeialHVVslOo/YGRJp0FCmbCQYLtgCAwM2:t0lW/EtxbdzeialHVOl/9oFCVQYSCA
Threatray 4'693 similar samples on MalwareBazaar
TLSH T1B194E0509A7E5A63E2C5737EAF42C3B003728E4C2202D79525E87D2F3EBFB5394452A5
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter abuse_ch
Tags:exe scr SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New.Purchase-Order2023.scr
Verdict:
Malicious activity
Analysis date:
2023-03-22 16:03:36 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/9d5a8efe-780f-42fa-bfae-fd1edfc271ba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/376520/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Enabling the 'hidden' option for analyzed file
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/641b251c3b01ade53e706c24/reports/d69651a3-e41e-4b6e-bbf6-ef785380d631/overview
Verdict:
Malicious
Labled as:
Trojan.Mardom.PN.Generic
Link:
https://www.hybrid-analysis.com/sample/008a18d1c20cb7b7bf26846bafe486b277c90bbb0cc7d1380645513818f5041c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/671cd001-7ec1-4aa2-a488-8e0dd559447e
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1199972
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/008a18d1c20cb7b7bf26846bafe486b277c90bbb0cc7d1380645513818f5041c/
Threat name:
ByteCode-MSIL.Trojan.Mardom
Create hunting rule
Status:
Malicious
First seen:
2023-03-22 13:01:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
17 of 37 (45.95%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=acfbruocbs33ppzgqrv27zegwj34sc53btd5coagivitqghvaqoa._file
Verdict:
malicious
Similar samples:
0c6f4e98596c6b3523cb53d8dfd7b97c5eabc2a8886faa597cf2df340084a469
SnakeKeylogger
6af36c9fc050eaf0914a5b314986c7333ef5cf2ea5de0e9ad6e48e584e2e7f54
SnakeKeylogger
6d2189719085c6f3191fd868643aae9449bd49c5e6a0076f5112b7281130b99d
SnakeKeylogger
70d3e45f0a41222ee06aa33124206699e822e01114b968b80d1419013fd9a623
SnakeKeylogger
8c4cc2077f0eab36be58bb86b34035f1b9c133902630526f609ff0c194f4f236
SnakeKeylogger
a482218c80bb91030f21119952bad2383fc9a5b69dfcd954b5b80585858fbd56
SnakeKeylogger
+ 4'683 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230322-tddxesbf7y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
b236dff0df818bbf4fbf78ff08490b00a1f6872c1db11d4cd2827189c72ed7d2
MD5 hash:
39910e89e009a951c7b7b36522f57c16
SHA1 hash:
f0a3c75ec22270e798ec7fe0367067b50d6a80d7
Link:
https://www.unpac.me/results/5d18f110-3bf1-4a2b-b2a5-65f7fd888b06/
SH256 hash:
959d00e502b10c39780511c7741807a4f11395dfb5c661ab972add06776ceaef
MD5 hash:
f7f7a54d63c4f18ac408948e4df0b1fc
SHA1 hash:
ec7969b2b747e9d25c4809338cf68d17f6b0a0c4
Link:
https://www.unpac.me/results/5d18f110-3bf1-4a2b-b2a5-65f7fd888b06/
SH256 hash:
b3989d4d18d05065dd8bc0d989e0ad0fd01d00b36725463391ea9f84d216022e
MD5 hash:
97db6cd8b591dbd4acb5b473043b4d84
SHA1 hash:
d293b10d89063db8b5532ea55d5242c646fde36c
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/5d18f110-3bf1-4a2b-b2a5-65f7fd888b06/
Parent samples :
529570238c49330b949a4cc1a6623e05bfe5ac9af493b701321d786e6d838068
c975e6ea0c4d29a77b8fb8cc4ca15453387a066b4b237c45076b35b2475480aa
077c21196f9977ccbb68c78ec7c2687bda9b3be0ac0a387080e337d841ee1fac
259003dd09af10934997d24fb92c517aa1e1881b006a71f4646ae85f6a6c6ae5
008a18d1c20cb7b7bf26846bafe486b277c90bbb0cc7d1380645513818f5041c
d0a101d03dba528a94c83f78c965018dee7fbc198ebfa5c251ad788672b7a127
218837a31e5d0be80334b33216d047700a3f0983d847ea6019f5a5e638e69f56
4d83125a53744cf0b65a3fc7160965548b504348d1d26146e35420aecf5d26c2
SH256 hash:
008a18d1c20cb7b7bf26846bafe486b277c90bbb0cc7d1380645513818f5041c
MD5 hash:
87ca07e743d3730635842f25ec99398d
SHA1 hash:
98332ba6ff6b3a8b1eb96f5e7cae4d545b24c3af
Link:
https://www.unpac.me/results/5d18f110-3bf1-4a2b-b2a5-65f7fd888b06/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/008a18d1c20c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/376520/

Comments