MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 023b0bbfafcbf481a2d5e4410160c6b07a4db1e14ae4f42e491a49e202a1f68c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	023b0bbfafcbf481a2d5e4410160c6b07a4db1e14ae4f42e491a49e202a1f68c
SHA3-384 hash:	a6172226066515335ca80a6fbb9e6b3cd84883d59642cfea87ce3c35dd0af5ddd23ca93ea8c182c553371b5b286fd842
SHA1 hash:	f8698fb682baf918f7bd40a2d5490fd6cb8a1d90
MD5 hash:	ffb867664aa5e35b85d4b51137b309c9
humanhash:	nineteen-sierra-beer-carolina
File name:	Consignment Shipment Guide.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	848'384 bytes
First seen:	2021-03-05 12:59:11 UTC
Last seen:	2021-03-05 15:20:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	12288:8+Sgb10QmhH0GEIGx1GujoF8+hKQrM0oNv3upcBNta/ml/c+L:8+B6AfCjF1PtGv3upcsk
TLSH	9105C090C63A1890F99F5F3B64B60D148D222E79712E941D7AEEB2360C7E672017DE4F
Reporter	abuse_ch
Tags:	exe SnakeKeylogger TNT

abuse_ch

Malspam distributing SnakeKeylogger:

HELO: server.bebranded.com.au
Sending IP: 70.32.25.208
From: TNT Express INC <service@tnt.com>
Subject: TNT Express shipment per-alert!!
Attachment: Consignment Shipment Guide.r00 (contains "Consignment Shipment Guide.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

129

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Consignment Shipment Guide.exe

Verdict:

Malicious activity

Analysis date:

2021-03-05 13:00:17 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d5041402-41e3-4922-891a-f40205612cfd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/122452/

Detection(s):

SecuriteInfo.com.ArtemisFFB867664AA5.11773.16620.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Creating a file

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Creating a window

Sending a UDP request

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/629745

Signature

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Beds Obfuscator

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/023b0bbfafcbf481a2d5e4410160c6b07a4db1e14ae4f42e491a49e202a1f68c/

Threat name:

ByteCode-MSIL.Trojan.Woreflint

Status:

Malicious

First seen:

2021-03-05 12:08:13 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ai5qxp5pzp2idiwv4raqcyggwb5e3mpbjlspilsjdje6eavb62ga._file

Verdict:

unknown

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210305-v7bwhl8zca/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Beds Protector Packer

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf

MD5 hash:

8cd28be4bd9a1404c6d3600db32b3ed1

SHA1 hash:

fb90b0ca51118e771390d58b19d0a404ee14cfbc

Link:

https://www.unpac.me/results/5f148d7e-c203-428c-ba87-ae4fb82d8de5/

SH256 hash:

c110303acfabd0e9259c61e41db57e278b0207928dab9c690f160ef9eb0a0e42

MD5 hash:

b928a54d6bec5cb34270073b703de5ed

SHA1 hash:

7c41b218b0502d3c098b61cc8ee265dfe1803c33

Link:

https://www.unpac.me/results/5f148d7e-c203-428c-ba87-ae4fb82d8de5/

SH256 hash:

7ea20b7611543f13c9615203382cbed757b774e94ca4786bbd745f51d2b8f525

MD5 hash:

cb94f137ad890173f68d6f642ef31732

SHA1 hash:

5dccc499f11d2c9b0e7addec3c150a5046372c61

Link:

https://www.unpac.me/results/5f148d7e-c203-428c-ba87-ae4fb82d8de5/

SH256 hash:

023b0bbfafcbf481a2d5e4410160c6b07a4db1e14ae4f42e491a49e202a1f68c

MD5 hash:

ffb867664aa5e35b85d4b51137b309c9

SHA1 hash:

f8698fb682baf918f7bd40a2d5490fd6cb8a1d90

Link:

https://www.unpac.me/results/5f148d7e-c203-428c-ba87-ae4fb82d8de5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/023b0bbfafcbf481a2d5e4410160c6b07a4db1e14ae4f42e491a49e202a1f68c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector