MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0511e5650e0fe3185a93968951c041ba9eaeaa8e1bf5f9d83007ac362763b88c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0511e5650e0fe3185a93968951c041ba9eaeaa8e1bf5f9d83007ac362763b88c
SHA3-384 hash: 676a32cc891c7c85d45a5b73692b978dbf0000c5d33eeaadda5fe774a1a17049fc629fac407da83b35de25d538111f29
SHA1 hash: 32355cf4cf32ed80c622732bf031e8c6cf9a3eda
MD5 hash: f2de0db05ee2c6d7d29055065a22cd42
humanhash: jupiter-romeo-tennessee-texas
File name:NEW ACCOUNT DETAILS.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:849'920 bytes
First seen:2023-01-27 14:00:48 UTC
Last seen:2023-01-31 15:09:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:v+T8irmdjXHNOrAe/Iu8mBDCQSchYVSRgmIcewrqhTPVcHqh:vtOD0cMSRgmCwrCPVcHqh
Threatray 7'482 similar samples on MalwareBazaar
TLSH T1C105B4E8283697F5CBB0BA3152A057F0AD4F6E62639FDCB9B9D13BC00B31541A9C911D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f0f0e0e8dce0f0f0 (1 x RemcosRAT, 1 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NEW ACCOUNT DETAILS.exe
Verdict:
Malicious activity
Analysis date:
2023-01-27 14:01:17 UTC
Tags:
evasion trojan snake keylogger
Link:
https://app.any.run/tasks/473c6451-413f-4b2e-a3c8-54cd83af282e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/357405/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63d3d923528134caf0435411/reports/37827ca4-23ee-4895-8c70-94667864d1c5/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/05041d9b-77eb-40a1-a873-d1b6150c0507
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1160238
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large strings
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 792975 Sample: NEW ACCOUNT DETAILS.exe Startdate: 27/01/2023 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Sigma detected: Scheduled temp file as task from temp location 2->47 49 11 other signatures 2->49 7 UdGTiv.exe 5 2->7         started        10 NEW ACCOUNT DETAILS.exe 6 2->10         started        process3 file4 51 Multi AV Scanner detection for dropped file 7->51 53 May check the online IP address of the machine 7->53 55 Machine Learning detection for dropped file 7->55 13 UdGTiv.exe 14 2 7->13         started        17 schtasks.exe 1 7->17         started        27 C:\Users\user\AppData\Roaming\UdGTiv.exe, PE32 10->27 dropped 29 C:\Users\user\AppData\Local\...\tmp7018.tmp, XML 10->29 dropped 31 C:\Users\user\...31EW ACCOUNT DETAILS.exe.log, ASCII 10->31 dropped 57 Injects a PE file into a foreign processes 10->57 19 NEW ACCOUNT DETAILS.exe 15 2 10->19         started        21 schtasks.exe 1 10->21         started        signatures5 process6 dnsIp7 33 193.122.6.168, 49696, 80 ORACLE-BMC-31898US United States 13->33 35 checkip.dyndns.org 13->35 59 Tries to steal Mail credentials (via file / registry access) 13->59 61 Tries to harvest and steal ftp login credentials 13->61 63 Tries to harvest and steal browser information (history, passwords, etc) 13->63 23 conhost.exe 17->23         started        37 checkip.dyndns.com 132.226.8.169, 49695, 80 UTMEMUS United States 19->37 39 checkip.dyndns.org 19->39 41 192.168.2.1 unknown unknown 19->41 25 conhost.exe 21->25         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0511e5650e0fe3185a93968951c041ba9eaeaa8e1bf5f9d83007ac362763b88c/
Threat name:
Win32.Trojan.SnakeStealer
Create hunting rule
Status:
Malicious
First seen:
2023-01-27 09:55:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
16 of 39 (41.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aui6kziob7rrqwuts2evdqcbxkpk5kuodp27twbqa6wdmj3dxcga._file
Verdict:
malicious
Similar samples:
028507b3f93e498c7d63fc91bd7a02f85d684c5c64b298333c6e207f3e40d2d5
SnakeKeylogger
0bbc61629171137fcf90a07950ef649620c67a2dacf3a473b8b39fe0fe3c3945
SnakeKeylogger
18824045ac4b14baa21003dfc20b607d2b2a7fedd09bae62382bf66cd20df0d0
SnakeKeylogger
2665999d8c6d7ef85011d6e6429512d13397c07b7949329d61eecf79eb66f9b5
SnakeKeylogger
2ca9e2712098e5b6a7e425f1d99c1df463922aa5b67fe587ee0406c8b4b38d43
SnakeKeylogger
2f77a0882a1faa6b040bb17d2bc63a5a154835d46adedd98339eba6599974655
SnakeKeylogger
7133536be647a4809ef0e92fc1c0ca8a49db7ed0c79aad39874ae7731bc849b5
SnakeKeylogger
757bbc65cd11c88a4b5852e131522b2dfd2a2ada73b14c49065e2da7f8ce14f4
SnakeKeylogger
75b63a60b84466c77bf73bdaa329d3769c749576c737719e00cf3f96c6de0115
SnakeKeylogger
de2e0c532da36b42ce3d7798e97fbf1c8a9bedc9ce181ded5cd62e3ca428a0a5
SnakeKeylogger
+ 7'472 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230127-rbjnsach7s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot1707668650:AAFJBUcmT6aGlXwy3-beDARhm0ji930DCzM/sendMessage?chat_id=1772363493
Unpacked files
SH256 hash:
f82d4bf766e06b6723e6edfb03152c53c4677b4d5399dc01d88fd0d0610d3066
MD5 hash:
a433c12ddf1877e55c9be82562485ea2
SHA1 hash:
a7c5f64a567a512d0d523d0ae5e91062ea9eaa10
Link:
https://www.unpac.me/results/1a8b81b9-5923-4121-b491-1f153e754af9/
SH256 hash:
e62804709fb339e665fa5ce184ee3c07647133db814ec7f196f09e80ba20982f
MD5 hash:
83a44210a126781425a91a82577008a9
SHA1 hash:
70800aa55850834d363aa2030fafa56b06f01aae
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/1a8b81b9-5923-4121-b491-1f153e754af9/
SH256 hash:
94c2ba257a21a0eb4527346753abdedc7bb2fe3aa72d20642546994626602129
MD5 hash:
874dcc6be499121b1425bfdff1f8ad46
SHA1 hash:
66f83bedc73876b77e152c604b8214bde86d965e
Link:
https://www.unpac.me/results/1a8b81b9-5923-4121-b491-1f153e754af9/
SH256 hash:
0511e5650e0fe3185a93968951c041ba9eaeaa8e1bf5f9d83007ac362763b88c
MD5 hash:
f2de0db05ee2c6d7d29055065a22cd42
SHA1 hash:
32355cf4cf32ed80c622732bf031e8c6cf9a3eda
Link:
https://www.unpac.me/results/1a8b81b9-5923-4121-b491-1f153e754af9/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0511e5650e0f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/0511e5650e0fe3185a93968951c041ba9eaeaa8e1bf5f9d83007ac362763b88c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 0511e5650e0fe3185a93968951c041ba9eaeaa8e1bf5f9d83007ac362763b88c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/357405/

Comments