MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02685362904bee33572377f950796a0fd3a7dd7579c05c1503248bd9d08fc9f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02685362904bee33572377f950796a0fd3a7dd7579c05c1503248bd9d08fc9f4
SHA3-384 hash: 0640f901d00acbcd428d47cbf902604a83fa16a2f6f7ed5f18b3a6484734df6693612d668336d6c42b38844bd6035986
SHA1 hash: f24db5f7e3caec74304f1176171733b5a2e56dbf
MD5 hash: e064952817e4514a39b19809e160184a
humanhash: high-queen-connecticut-blossom
File name:n69arLP8PRRdmz7.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:634'368 bytes
First seen:2023-01-30 10:33:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:BPh1SYqsFoWUqZJsx+oSwPy/EAMWeh3ih9HXA:BJViWUsJNoSwPYMBYTQ
Threatray 11'373 similar samples on MalwareBazaar
TLSH T162D412E64319CDF5CB94023B27B8449C9F3226F9F166C74C02AF9615C88B31196B37EA
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon cc9692b83832968e (13 x AgentTesla, 8 x SnakeKeylogger, 4 x Loki)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
n69arLP8PRRdmz7.exe
Verdict:
Malicious activity
Analysis date:
2023-01-30 10:36:32 UTC
Tags:
evasion trojan snake keylogger
Link:
https://app.any.run/tasks/082f9232-d953-496c-8bcd-f9ad0ced6693

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/358226/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Forced shutdown of a browser
Verdict:
No Threat
Threat level:
  2/10
Confidence:
80%
Tags:
packed
Link:
https://www.filescan.io/uploads/63d79d23447edb203a020492/reports/a3fb8bf0-a3ea-4995-b0bf-52f01d28bc98/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/96c74608-c914-407f-93b7-d9fad6e82c19
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1161492
Signature
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02685362904bee33572377f950796a0fd3a7dd7579c05c1503248bd9d08fc9f4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-01-30 01:32:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ajufgyuqjpxdgvzdo74va6lkb7j2pxlvphafyfidesf5tuepzh2a._file
Verdict:
malicious
Similar samples:
4826ace8391d200aa066ceb967aad44fc540670826c59538aa0df039d2c2421c
SnakeKeylogger
4f5ea72df2ff98979013fbfe0781a01d8d487d886ebc5012e037f553527996d2
SnakeKeylogger
6a9d3a6f928c5a2a9ab9abe269027f3b987045fbb30803dd431ae2f56d5f859c
SnakeKeylogger
8572c3b461f643bf5baaeb032cf81f83af78dcc60e34d98c669d12f748bb38f3
SnakeKeylogger
8878359c93d36d0849467e895c724bd5a171a4ac97f29217aca79645f3c57a40
SnakeKeylogger
8fc56654c730505dd97bbe04e8c9f688b7b9366eb1981e848fe3c829a553f40d
SnakeKeylogger
d943f08a35dc06253557151dbff927a9eb4c26f425d328cf612cb7e5211c3822
SnakeKeylogger
ef208a2f463e7c3b8ea5c01332d60d691018a27fb0baf080fb2b42bad34b1d07
SnakeKeylogger
+ 11'363 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230130-ml7fdaaa78/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5816458649:AAFS1obzDKYH_QeQC_kvYxhd80vhKb3q6Vs/sendMessage?chat_id=5586449047
Unpacked files
SH256 hash:
178cc7474b323b0ae6b3095ff67127726530d9d44be5cb58ba7315ef3a1199ad
MD5 hash:
159af9cf7f94d64c8120c80268965306
SHA1 hash:
fb41ab37af2c83e96d97e9cd066f90e72d4887ea
Link:
https://www.unpac.me/results/cfa58487-5a98-43f7-b96f-c3e50416f373/
SH256 hash:
f78bc81e34e9c41053beb84a500e3e2065c66ae4c84b7fe46553934e5db75a81
MD5 hash:
386846598ed1914f186f593b4232bbd4
SHA1 hash:
eaf53b8753d7a9be4b679827405c5a6fec742489
Link:
https://www.unpac.me/results/cfa58487-5a98-43f7-b96f-c3e50416f373/
SH256 hash:
54d781f0dee6692c47390edf1ada295fb17a7e80ed5ccd58ab14c6ddf80a0ad8
MD5 hash:
4f6caebd865502f7c8046fbae3284c61
SHA1 hash:
be357e832bf6f61454875b37a1759cf1c5fa5ca4
Link:
https://www.unpac.me/results/cfa58487-5a98-43f7-b96f-c3e50416f373/
SH256 hash:
8d2bef50f86f57173b166b051f10221568bb0c61dc05cc84ba9932fbeaf14329
MD5 hash:
df8f094500658d8f14740f11048e537c
SHA1 hash:
10fda13aae1a85b7d70c7c3228ab841b5f066be8
Link:
https://www.unpac.me/results/cfa58487-5a98-43f7-b96f-c3e50416f373/
SH256 hash:
2cada9765564ef0645c4e788c3b10858cec3963f1c84719dab4dffae5d9043c6
MD5 hash:
1a1c3343d3c9b2cc913f72c8ba56841b
SHA1 hash:
0896637b64d0198ea669dcd28a0b9aecae96198f
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/cfa58487-5a98-43f7-b96f-c3e50416f373/
Parent samples :
02685362904bee33572377f950796a0fd3a7dd7579c05c1503248bd9d08fc9f4
324c3680a1522f4d16471daf7537cfb9e280bc8f71ab5e4f4d39a89789cbf112
SH256 hash:
02685362904bee33572377f950796a0fd3a7dd7579c05c1503248bd9d08fc9f4
MD5 hash:
e064952817e4514a39b19809e160184a
SHA1 hash:
f24db5f7e3caec74304f1176171733b5a2e56dbf
Link:
https://www.unpac.me/results/cfa58487-5a98-43f7-b96f-c3e50416f373/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02685362904b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/02685362904bee33572377f950796a0fd3a7dd7579c05c1503248bd9d08fc9f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/358226/

Comments