MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0117281695e189549e868c64114a1c4540f9f441a83ff8cffc61b60658ee9639. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 15

Intelligence 15 IOCs YARA 12 File information Comments

SHA256 hash:	0117281695e189549e868c64114a1c4540f9f441a83ff8cffc61b60658ee9639
SHA3-384 hash:	5fe64f1ba20357b6b5032a6b4ab99c29e77ebbc48a98c06e6cbff9e6c1c595d7325d42f9253c6c0f0c9e17cac425cdc8
SHA1 hash:	7f7e421de4faa648f5275be329c65b1d229cc0e7
MD5 hash:	9378f5d6f132830d5cbebd1230b38e9e
humanhash:	maine-west-paris-don
File name:	Fatura.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	262'599 bytes
First seen:	2022-12-13 16:06:46 UTC
Last seen:	2022-12-15 00:57:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	97318da386948415d08cef4a9006d669 (71 x Formbook, 35 x SnakeKeylogger, 26 x AgentTesla)
ssdeep	6144:FkwqfZHrUVin1z6RsAFbEAU5e4GX8Bbqol/0k6vg/dYE/h5dfz2pmpoEyeqOk:OfZHrH1gsAdEb5e4E8lD/0ZvSa05dffw
Threatray	5'095 similar samples on MalwareBazaar
TLSH	T1A844121A25A4999FDA93483284DFD36AC7B59C22011229C72BF03F191772EC6DC4F56F
TrID	92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133) 3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 1.1% (.EXE) Win64 Executable (generic) (10523/12/4) 0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	69e8bce9f0f87939 (16 x SnakeKeylogger, 1 x AgentTesla, 1 x Loki)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Fatura.exe

Verdict:

Malicious activity

Analysis date:

2022-12-13 16:10:53 UTC

Tags:

installer evasion trojan snake

Link:

https://app.any.run/tasks/31c58cce-ca73-425c-a158-b1ca72fbaf8b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

SecuriteInfo.com.Gen.Variant.Lazy.274607.17519.14184.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file in the %AppData% subdirectories

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Reading critical registry keys

Creating a window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/6398a32a9a505ad9423f90bf/reports/9df2c675-75c5-4f1d-80bd-1f8b0d26dbdd/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0bb43606-444d-45fd-b5b6-77d67fb33ce5

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1133540

Signature

.NET source code references suspicious native API functions

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0117281695e189549e868c64114a1c4540f9f441a83ff8cffc61b60658ee9639/

Threat name:

Win32.Trojan.NSISInject

Status:

Malicious

First seen:

2022-12-13 08:18:19 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aelsqfuv4gevjhugrrsbcsq4ivapt5cbva77rt74mg3amwhosy4q._file

Verdict:

malicious

SnakeKeylogger

2a86cef8daa33cf5fafe90da289e8a27ce3cd3aa11054ad257bce28aff25e87b

SnakeKeylogger

397be5bd6dd070eb7cb65a18294fbebc7d103d60de335ae146973e728e134f93

SnakeKeylogger

62ae48d339e52a1b5be82e703025f2be10d6025f97fd784d40f2781d6ee886ec

SnakeKeylogger

b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3

SnakeKeylogger

bb8796a9e1daa6418cbc7fceaebbf08608bbf85f8af57ee4ddabdf388024cc87

SnakeKeylogger

f6f9f7b0dda34e762db1c1d5362ad44638246bc1ff5832789177869d0e393203

SnakeKeylogger

fec53b388671f2f82fd8c743a3695f432037caffe5f2e04ea77c206809efd048

SnakeKeylogger

+ 5'085 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger persistence spyware stealer

Link:

https://tria.ge/reports/221213-tkmsxahf9z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Executes dropped EXE

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot5402813712:AAG__8vfwqo_1K9XHIpxzTR9T7UW4raysO4/sendMessage?chat_id=5034680713

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/6ad1cfbd-cadd-426e-87ed-1535563f7522

Unpacked files

SH256 hash:

b4a18afee5beea0467dff9680bdb0434d14110a0cca7763ce603be21158914c4

MD5 hash:

9065c42c8ba208e5bfd0f2e90578d7da

SHA1 hash:

d9da751543a10473bb34425e04e41ab5ed7f15d8

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/b07290a8-f564-4dd6-9f1f-befc31b9b919/

SH256 hash:

743bdfd90c1176f75859f903ddfe9f13a9ca07f2220a91b798095b182e174cb6

MD5 hash:

0f534e8b493c586dcbd891d1c1e941e4

SHA1 hash:

4204b40d0699d4795ea1a00b1248db20c46c5696

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/b07290a8-f564-4dd6-9f1f-befc31b9b919/

Parent samples :

e38bd377579282e050e45726f6b26465153a953d5b46507a5e3a9e4be8e6de01
f8c2496f2dfa0c90ab0883da65ef8e6521a6253445b9627e50d2c859ed3c0536
a291b7903b0d6f24b9a03abc38260c0ebf159afc41e15fec5f44b50638ce51af
29646ec02e298c3cac81b5cf34c146724705197b5e651c562103226ffee3763e
250bc712f1c6f615d2d0048709b5a699eaff9dd73c83d1698101e2c51042102a
0f59a49a96bb1e93a00093b5b6a39f7a7df748e1c439b7cdd6d62e4c9b5f30d4
cdfde1c662d52aa35785247dc0eda008fa462e0b552dc56358e740c3f196e973
2b0f398cbf4b1b5389902edb124ed7dff609fc9d96942aaba149ed03942bbf2c
deac8ad34ff6f59a3ccdb8161f7aff94cdb9780d74201f77142c34bccf0fcd18
6c317cf17fd580577d0d326188f5ad3200eec4a1b1c0e426c30ce73001114941
ddef9ddc5c621654d2cef10a8a1c2da7cc409784814a517f34c39c3dbd8c3e89
2b05c82d97fec0402f8a03acf466c13c09a69cebda207c35cedb40102bb8cad8
43b7d703f9ea0049dbdf0754eabc0cfdbe9e8e7e21fd423a5a800ea957d624b3
6244e1ccfa5a2df0cf729efd89ad8ffa7558d44ba9c01363c3886cc4ec445a1b
9c9e05c8a99f909e778ab5f437d3fbd5a7a3b643a71248ed110f41a97079840e
36969e849dcfa8492696980c5bba97a05bd47ce1ce43127410abc90de2208698
a1689d72306cf3dcdc8a3319008387ea66113ec85575ad4b0c905084e6aba306
2a86cef8daa33cf5fafe90da289e8a27ce3cd3aa11054ad257bce28aff25e87b
0117281695e189549e868c64114a1c4540f9f441a83ff8cffc61b60658ee9639
95ed52837008a838dfe100d211d1a1747e709101d40455bc64d4b7f55bb442cc
d1341b24ccf6b853b6c0cb85f174b42318b8731dcf2155d335b015981882bf9d

SH256 hash:

0117281695e189549e868c64114a1c4540f9f441a83ff8cffc61b60658ee9639

MD5 hash:

9378f5d6f132830d5cbebd1230b38e9e

SHA1 hash:

7f7e421de4faa648f5275be329c65b1d229cc0e7

Link:

https://www.unpac.me/results/b07290a8-f564-4dd6-9f1f-befc31b9b919/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0117281695e1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.93

Link:

https://yomi.yoroi.company/submissions/0117281695e189549e868c64114a1c4540f9f441a83ff8cffc61b60658ee9639

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AsyncRat_Detection_Dec_2022 Create hunting rule
Author:	Potatech
Description:	AsyncRat

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

exe 0117281695e189549e868c64114a1c4540f9f441a83ff8cffc61b60658ee9639

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/345884/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample