MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f9c43e16d8b5a44dbdfe53a6f9bf132691c798ba435b697b98a793eb76d5930. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f9c43e16d8b5a44dbdfe53a6f9bf132691c798ba435b697b98a793eb76d5930
SHA3-384 hash: 7cc4ccdb9efc2bde742a9c46a5b38c51bc4f3fe6c357373ab33745a680518127c467813384eb84adc8824e98b99c65b8
SHA1 hash: 011e66db9812e19bc67c6894cc9177c48ae6b7a1
MD5 hash: db70f171068e153a65a20e376143c527
humanhash: sixteen-vermont-earth-sink
File name:crypt zeco.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:594'432 bytes
First seen:2021-02-10 10:34:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:yOJ0qvtMWjQ/TeeeBmgn4Xd9feOdfuHyCjGeFEJi+1h94oqocSSiB/:yM0qeVReBvn4N9GOdfEyCadQ+1h9c
Threatray 6 similar samples on MalwareBazaar
TLSH 0AC4CFFB355885C6CE3F52B47A85C3F9A9D75D810992E60082FB31E9A776708143BB2C
Reporter abuse_ch
Tags:DHL exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: mail.ostfold.net
Sending IP: 217.171.199.99
From: DHL Customer care <info@dhl.com>
Subject: DHL GLOBAL FORWARDING
Attachment: crypt zeco.zip (contains "crypt zeco.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6.exe
Verdict:
Malicious activity
Analysis date:
2021-02-10 10:25:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b08a50cf-7bae-4d8c-822c-dd2c935abdc8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/116483/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Unauthorized injection to a recently created process
Sending a UDP request
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/604259
Signature
Bypasses PowerShell execution policy
Drops PE files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Powershell drops PE file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 351159 Sample: crypt zeco.exe Startdate: 10/02/2021 Architecture: WINDOWS Score: 92 41 Multi AV Scanner detection for dropped file 2->41 43 Yara detected Snake Keylogger 2->43 45 May check the online IP address of the machine 2->45 47 3 other signatures 2->47 7 crypt zeco.exe 2 2->7         started        9 I$s#$lT3ssl.exe 2 2->9         started        process3 signatures4 12 powershell.exe 15 7->12         started        16 crypt zeco.exe 15 2 7->16         started        49 Injects a PE file into a foreign processes 9->49 19 I$s#$lT3ssl.exe 2 9->19         started        21 powershell.exe 19 9->21         started        process5 dnsIp6 27 C:\Users\user\AppData\...\I$s#$lT3ssl.exe, PE32 12->27 dropped 29 C:\Users\...\I$s#$lT3ssl.exe:Zone.Identifier, ASCII 12->29 dropped 51 Drops PE files to the startup folder 12->51 53 Powershell drops PE file 12->53 23 conhost.exe 12->23         started        31 checkip.dyndns.org 16->31 33 checkip.dyndns.com 131.186.161.70, 49725, 49726, 80 DYNDNSUS United States 16->33 39 2 other IPs or domains 16->39 55 Tries to steal Mail credentials (via file access) 16->55 57 Tries to harvest and steal browser information (history, passwords, etc) 16->57 35 checkip.dyndns.org 19->35 37 216.146.43.71, 49744, 49745, 80 DYNDNSUS United States 19->37 25 conhost.exe 21->25         started        file7 signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f9c43e16d8b5a44dbdfe53a6f9bf132691c798ba435b697b98a793eb76d5930/
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 10:35:07 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6oehylnrnnejw674u5g7g7rgjury6mluq23nf5zrj4t5n3nleya._file
Verdict:
unknown
Similar samples:
1d8325674575fba8a9e1af76da040680cce1ba448006345c8d58305406dabfc3
SnakeKeylogger
1dc2a4dd6e7e1525ff0e92f87bf12b95f62eb5750bdec7a41d40e49a3b2f9d81
SnakeKeylogger
456e1777842abed818675011ff1580023356588b1f69b9c2c363c2abcaf407c2
SnakeKeylogger
619ab2c40c40c107e921df3ccd7f44946ab5a353939da1f3834213f3a507a4c0
SnakeKeylogger
a0f7635bbcb14187feb63b10c5c5d25de66efbae8a592a62d782684cfc3fd94b
SnakeKeylogger
ab23beb259fe20a76af05b4b498dec847db8d765c71abcbe5bd60c76d5d72cda
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210210-mdrb4ct9za/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/3ba2978a-2602-4437-8d04-a1b86cbec8fb/
SH256 hash:
519b69e7efe4f5bd26edeb11f63c4789a9d4514593f6a83a81e48d4abf39f711
MD5 hash:
6d896fee9e903e409a7006eecd769641
SHA1 hash:
ecbd1774fcfa11bd2d18bc8cde479ec71b6085c9
Link:
https://www.unpac.me/results/3ba2978a-2602-4437-8d04-a1b86cbec8fb/
SH256 hash:
6925dbcc137d8bafe274893068bb5549fe0a349ba89adf576718641c5ada7044
MD5 hash:
64718868d708882f264dd88628e4dd9c
SHA1 hash:
92df516707efcc50edc1f10d538f4ab0e97a2ed8
Link:
https://www.unpac.me/results/3ba2978a-2602-4437-8d04-a1b86cbec8fb/
SH256 hash:
0f9c43e16d8b5a44dbdfe53a6f9bf132691c798ba435b697b98a793eb76d5930
MD5 hash:
db70f171068e153a65a20e376143c527
SHA1 hash:
011e66db9812e19bc67c6894cc9177c48ae6b7a1
Link:
https://www.unpac.me/results/3ba2978a-2602-4437-8d04-a1b86cbec8fb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f9c43e16d8b5a44dbdfe53a6f9bf132691c798ba435b697b98a793eb76d5930

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

tar 15308ecc7f68195a1a70805912d34aaa45a0e456359d200d5fa08f9bd96371c0

SnakeKeylogger

Executable exe 0f9c43e16d8b5a44dbdfe53a6f9bf132691c798ba435b697b98a793eb76d5930

(this sample)

  
Dropped by
MD5 db74c2a72de4d9248c8605755382341e
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/116483/
  
Dropped by
SHA256 15308ecc7f68195a1a70805912d34aaa45a0e456359d200d5fa08f9bd96371c0

Comments