MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 085432a1c99fa59ffaf3838e1a987e17df690bfd19fe6ad001ee7d9d6fba3eb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 085432a1c99fa59ffaf3838e1a987e17df690bfd19fe6ad001ee7d9d6fba3eb4
SHA3-384 hash: e1a0c6e54274b1baaf7a6fcdd2aad6d497548271ab593b59421a53722054225a6e2e1a5d7164f5ce223c6bdae5cbbfce
SHA1 hash: 7f0033b4a3958e14d1959555bbfbd58e667d460b
MD5 hash: 018ccb52b75e10cd4a45aa22aa7b2342
humanhash: oklahoma-violet-butter-friend
File name:018ccb52b75e10cd4a45aa22aa7b2342.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:312'048 bytes
First seen:2023-09-29 08:45:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9dda1a1d1f8a1d13ae0297b47046b26e (64 x Formbook, 39 x GuLoader, 22 x RemcosRAT)
ssdeep 6144:hnPdudwDvX6XTt3LWygobl2qgZbyWI2ku6nQ+i1ic3OYBsXA7L:hnPdj6ZKygjq0IZnK1wYMy
Threatray 2'234 similar samples on MalwareBazaar
TLSH T1536413E12770E8FBDA3119B25D3516136BEBB41A30658F0B93503EEC7C626B49C5DA23
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 64f4d4d4ecf4d4d4 (82 x SnakeKeylogger, 34 x AgentTesla, 24 x Formbook)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Strab-10009375-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Gathering data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control locky lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65168ed1f1b40cb0d6244a9d/reports/2798ed6b-041b-4c39-a7d8-e737b6da9748/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/085432a1c99fa59ffaf3838e1a987e17df690bfd19fe6ad001ee7d9d6fba3eb4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/880c45b3-4e6c-42b0-aa9d-ec02b06ae930
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1316264
Signature
Antivirus detection for dropped file
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1316264 Sample: EgFO4N6WxT.exe Startdate: 29/09/2023 Architecture: WINDOWS Score: 100 36 checkip.dyndns.org 2->36 38 checkip.dyndns.com 2->38 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 5 other signatures 2->60 8 EgFO4N6WxT.exe 18 2->8         started        11 ppyueenjjs.exe 2->11         started        14 ppyueenjjs.exe 2->14         started        signatures3 process4 file5 34 C:\Users\user\AppData\Local\Temp\rjxul.exe, PE32 8->34 dropped 16 rjxul.exe 1 2 8->16         started        62 Antivirus detection for dropped file 11->62 64 Multi AV Scanner detection for dropped file 11->64 66 Detected unpacking (creates a PE file in dynamic memory) 11->66 70 2 other signatures 11->70 20 ppyueenjjs.exe 14 2 11->20         started        68 Maps a DLL or memory area into another process 14->68 22 ppyueenjjs.exe 2 14->22         started        24 ppyueenjjs.exe 14->24         started        signatures6 process7 file8 32 C:\Users\user\AppData\...\ppyueenjjs.exe, PE32 16->32 dropped 42 Antivirus detection for dropped file 16->42 44 Multi AV Scanner detection for dropped file 16->44 46 Machine Learning detection for dropped file 16->46 52 2 other signatures 16->52 26 rjxul.exe 15 2 16->26         started        30 rjxul.exe 16->30         started        48 Tries to steal Mail credentials (via file / registry access) 22->48 50 Tries to harvest and steal browser information (history, passwords, etc) 22->50 signatures9 process10 dnsIp11 40 checkip.dyndns.com 132.226.8.169, 49709, 49712, 49717 UTMEMUS United States 26->40 72 Tries to steal Mail credentials (via file / registry access) 26->72 signatures12
Detection:
404keylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/085432a1c99fa59ffaf3838e1a987e17df690bfd19fe6ad001ee7d9d6fba3eb4/
Threat name:
Win32.Trojan.NSISInject
Create hunting rule
Status:
Malicious
First seen:
2023-09-25 15:11:27 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbkdfiojt6sz76xtqohbvgd6c7pwsc75dh7gvuab5z6z2352h22a._file
Verdict:
malicious
Similar samples:
58357272406c20e677f34777d792bdecc67f8502616621858a609d9cd8e3bd7e
SnakeKeylogger
59e8d4adc87713d6243f1130289d36da2fbd84aca576a0bc1a99d1728f29c756
SnakeKeylogger
5a8e4470e44f5566fba20c2b3962e04f40a688de11c46c02abb082e6e895a13a
SnakeKeylogger
7e0fa6073200440c8e01d79cf84c37d2671559a6b24575fc1407ac2166304ca4
SnakeKeylogger
86c93b4c01ca5cf2a505360e36677d0f5e5c159ba32a84019c8ef0e1e28cd596
SnakeKeylogger
88481fc9b8b2beb564ae58c9ad551d3810a15fbb58a7dc98944167e2f8f2dfd2
SnakeKeylogger
b125d23b3416c85b1f35d0d2f6d0f9aee2f1d905af6c79f39a9d6486033a6a45
SnakeKeylogger
dc5eb730f1df702be89804ca234b60fec5fed7b6ed8d6c719f7006f40775f888
SnakeKeylogger
f2121eddb8a7aef412069b5de7d10058c59f961c6a031ae6e5e3fd104663f076
SnakeKeylogger
+ 2'224 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/230929-kpa58sgg9x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
dec3bfdef29cbab1dcab58098b439e96ea5a4b7b03a47dc9cfea16bc4ee0435f
MD5 hash:
f349989874895162828483b02560076a
SHA1 hash:
65511ebe6f6d198644015e8dc381c4f4ee2ee850
Link:
https://www.unpac.me/results/de840443-9f55-42a6-8285-fccb7bf14ae8/
SH256 hash:
085432a1c99fa59ffaf3838e1a987e17df690bfd19fe6ad001ee7d9d6fba3eb4
MD5 hash:
018ccb52b75e10cd4a45aa22aa7b2342
SHA1 hash:
7f0033b4a3958e14d1959555bbfbd58e667d460b
Link:
https://www.unpac.me/results/de840443-9f55-42a6-8285-fccb7bf14ae8/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/085432a1c99f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/085432a1c99fa59ffaf3838e1a987e17df690bfd19fe6ad001ee7d9d6fba3eb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments