MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c
SHA3-384 hash: 6e482cfcfa61c686a1582a5a57799c239e2454c0cf4b4e8667c3e5f4ceafa0610ec41c96829e785af62b630680590e21
SHA1 hash: c0475d7c47bae96aa5421817d7b6af4ec70ff2ca
MD5 hash: 69078d32d9c984c300e2b2e270f2cd6f
humanhash: mexico-one-hot-carbon
File name:Yangi xarid buyurtma pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:923'648 bytes
First seen:2023-05-16 10:43:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:kYaH8C0wjY54jQQd7N1taRAHdYeWoAi/ZYY:Ycvv50QQRH/ZT
Threatray 640 similar samples on MalwareBazaar
TLSH T1F8150270209E4685E01BCBF164B8FD72027270F3EED9C9750B26A1C4CE67F546E98A5B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
259
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Yangi xarid buyurtma pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-05-16 10:45:26 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/f412808e-c925-4e79-b512-c94a0f13d411

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/390387/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.5753.24160.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64635e76f0ad4a59d6e2a1a4/reports/b0baa35a-83f8-497a-991b-276eccefa650/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac315ed7-f6af-4401-aa62-6d71543519c2
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1234373
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BrowserPasswordDump
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 867353 Sample: Yangi_xarid_buyurtma_pdf.exe Startdate: 16/05/2023 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 9 other signatures 2->55 7 Yangi_xarid_buyurtma_pdf.exe 7 2->7         started        11 LksvmW.exe 5 2->11         started        process3 file4 31 C:\Users\user\AppData\Roaming\LksvmW.exe, PE32 7->31 dropped 33 C:\Users\user\...\LksvmW.exe:Zone.Identifier, ASCII 7->33 dropped 35 C:\Users\user\AppData\Local\...\tmp47D0.tmp, XML 7->35 dropped 37 C:\Users\...\Yangi_xarid_buyurtma_pdf.exe.log, ASCII 7->37 dropped 57 Uses schtasks.exe or at.exe to add and modify task schedules 7->57 59 Writes to foreign memory regions 7->59 61 Allocates memory in foreign processes 7->61 67 2 other signatures 7->67 13 RegSvcs.exe 15 2 7->13         started        17 powershell.exe 21 7->17         started        19 schtasks.exe 1 7->19         started        63 Multi AV Scanner detection for dropped file 11->63 65 Machine Learning detection for dropped file 11->65 21 RegSvcs.exe 2 11->21         started        23 schtasks.exe 1 11->23         started        signatures5 process6 dnsIp7 39 checkip.dyndns.com 132.226.8.169, 49697, 80 UTMEMUS United States 13->39 41 checkip.dyndns.org 13->41 43 192.168.2.1 unknown unknown 13->43 69 May check the online IP address of the machine 13->69 25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        45 193.122.130.0, 49698, 80 ORACLE-BMC-31898US United States 21->45 47 checkip.dyndns.org 21->47 71 Tries to steal Mail credentials (via file / registry access) 21->71 73 Tries to harvest and steal ftp login credentials 21->73 75 Tries to harvest and steal browser information (history, passwords, etc) 21->75 29 conhost.exe 23->29         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c/
Threat name:
ByteCode-MSIL.Trojan.RemLoader
Create hunting rule
Status:
Malicious
First seen:
2023-05-16 09:51:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=avk3fptju7266gslhfek6nb5elo7hvpbwin6ed4ptoivdqcnfjwa._file
Verdict:
malicious
Similar samples:
005eb1d8df310f308e9ac99c488ea415174fd9aff3fc875117b056e535d08271
SnakeKeylogger
3b16426b7fffcd105a82ef228ea3abda230fe89dfb1c4be3ba57c3573da56831
SnakeKeylogger
4ea83aefa492b4ba2b49e13e34023674ed8b50373a9f521dc887178f60b60965
SnakeKeylogger
79105d7e93f40e7645cca097df1fe2ec3377f2ce05fb94faac893cfeafeb3e0d
SnakeKeylogger
9cedcc423c89f58cdef6386a96d9d57237cc0ce9b84622651691ec7e40d1e128
SnakeKeylogger
b809f6da220a4b9a46cd55eec616cd846349d6c9259b2623bd07e9eecf45a095
SnakeKeylogger
cd94bb8956e12aa67943b6bb657f17d2680b848b36f8726283a2037d1d588461
SnakeKeylogger
cecdd08e61f932e95f379ce175ea4845583efe4cfbea94b3d46ee2149089c57f
SnakeKeylogger
ed4b9afcb717295f5fb71bcc6f408dbbed12c6858ee2f20a1f7bd2ab72074fc6
SnakeKeylogger
fab58afbd986a4fb766f06edadc553c09b6422d1a54100f8ef1aa589f28f32f6
SnakeKeylogger
+ 630 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/230516-mstsvsac79/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6211212988:AAFOzoaaiFQNBwu5usRiioOfDPaKNvN0y1M/sendMessage?chat_id=1927031898
Unpacked files
SH256 hash:
68772dd39df57be9c3feeb25eb71d618ea024fe9951f237a85612a27c01d0c41
MD5 hash:
9304b8e3542296f079119d093f99c2d0
SHA1 hash:
f688cde8c1acaebac940526618a5696573ed5b82
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/82908fb1-16f0-4226-916b-29ad0b7791e2/
Parent samples :
0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c
192e207cdd8aa22ef3c05c208f59580976a35c5a3050902b940703cdd7f4c1fb
SH256 hash:
098c369a3b318acbc209cc951b8c52bb02c4a51585b36633ebca99e81aa127c2
MD5 hash:
5585bae99a4aca91a96127e8814804e2
SHA1 hash:
aabee8704ee1fb5c6064fb8e894ad127a0e0cc00
Link:
https://www.unpac.me/results/82908fb1-16f0-4226-916b-29ad0b7791e2/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/82908fb1-16f0-4226-916b-29ad0b7791e2/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
a7485443b331c2fca54197f53638cb11a8c82bac339b66f35b95d0ad0aceb438
MD5 hash:
dfca41d2838170cb07ef445bb7d9c987
SHA1 hash:
7622672bed23f065cafdf2a17879ebf5926aba8b
Link:
https://www.unpac.me/results/82908fb1-16f0-4226-916b-29ad0b7791e2/
SH256 hash:
cc16a13e63acdcf0327cbf468d57f679f1c12705641063c702305b47d952b90c
MD5 hash:
c67b2ec7281f9be9f21fc51f04e5f2ed
SHA1 hash:
7031872ca2692a6230579c5f4051c501cd8bcf0d
Link:
https://www.unpac.me/results/82908fb1-16f0-4226-916b-29ad0b7791e2/
SH256 hash:
0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c
MD5 hash:
69078d32d9c984c300e2b2e270f2cd6f
SHA1 hash:
c0475d7c47bae96aa5421817d7b6af4ec70ff2ca
Link:
https://www.unpac.me/results/82908fb1-16f0-4226-916b-29ad0b7791e2/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/390387/

Comments