MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 024dc716d487ab0ba41efd4bf824a6a18ca0174867c4754985bdb70a6d728d1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 024dc716d487ab0ba41efd4bf824a6a18ca0174867c4754985bdb70a6d728d1b
SHA3-384 hash: e3cdca4724cbe532e4bab07e612408658ee0259887788e2b00f34eb723a1f7524bfb8fa56121a4721405983e9dcb7872
SHA1 hash: 621d78365c7e52f1b3c2e3824176387a4dd65e33
MD5 hash: 9a8f2b21f9a1519f8c94b6b7ea315d4e
humanhash: july-sweet-vermont-aspen
File name:inter snake.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:45'496 bytes
First seen:2021-11-13 07:41:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 768:2Mdhz4sFnh7icDv0LZfrJPwuWNn6CvSYSg3l4hMAPnh7:jPt58ZfQggOhMGB
Threatray 1'625 similar samples on MalwareBazaar
TLSH T11013F916E10539FBC2070972C34AB555463B976F893F869A742F47AEE1C378903ADEA0
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205416/
Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed packed
Link:
https://www.filescan.io/uploads/618f6c14a00afa9663a5f076/reports/a4fa275f-b898-4ba6-bc96-b6dd03fa474b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6e46af47-2805-4b8b-9306-d71dc50601af
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888495
Signature
.NET source code references suspicious native API functions
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/024dc716d487ab0ba41efd4bf824a6a18ca0174867c4754985bdb70a6d728d1b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-12 07:07:58 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ajg4ofwuq6vqxja67vf7qjfguggkaf2im7chksmfxw3qu3lsrunq._file
Verdict:
malicious
Similar samples:
0827673ccd2ea519b7dc5992a11beae4a429b2588be92e94e20e16ad132e086c
SnakeKeylogger
0e826d9174ddb2554e1c7a78ee145a3348660256269716d15e9c5f1a4c8f01c7
SnakeKeylogger
2e3922c27678dd45b3cd465428d19c62a84cf8d242b8712919de61349eb5775d
SnakeKeylogger
3e22ce49e987a1d097778730877bd196bca1182772dbce70d75e109e1ed64702
SnakeKeylogger
609924bb2e3350f494553b8a7e91916766dae319d2b17550c8d97b403fc00794
SnakeKeylogger
76027f253ef7f7754a5813d939e23abaf53fe4bc4478d3f80bd09eada7419a49
SnakeKeylogger
7e64709cb86a58132d712f270d5672cd189bac61209b5ea91bda06ef57b27f38
SnakeKeylogger
df623c9ac537de8028b61717582bf71ee72949fc825da23c1167889454980f4b
SnakeKeylogger
f9bd994b0826622daf7a05f6afd563ce7c9e0c4ea5fbe06aa9b0fe7d68c95d21
SnakeKeylogger
+ 1'615 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/211113-jjnnpsegc5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
024dc716d487ab0ba41efd4bf824a6a18ca0174867c4754985bdb70a6d728d1b
MD5 hash:
9a8f2b21f9a1519f8c94b6b7ea315d4e
SHA1 hash:
621d78365c7e52f1b3c2e3824176387a4dd65e33
Link:
https://www.unpac.me/results/1211dfc3-be9e-45c6-8e8c-a6daf47fe656/
Malware family:
Phoenix
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/024dc716d487/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/205416/

Comments