MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
SHA3-384 hash: 1b6576e38c6076eaa81fd70760060f374cc52df65de8a5748da2aa4da3bd9593db71953c8d855afc69908be4c8ed1641
SHA1 hash: 7452d2d6765580c591ab921032bc42b3da9dc79d
MD5 hash: 9451b64c517dd1cdf73f9ea6e931e693
humanhash: pizza-burger-virginia-louisiana
File name:9451b64c517dd1cdf73f9ea6e931e693.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:721'408 bytes
First seen:2022-11-10 12:33:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:tiD8plm3BEHlO9BeZM/6+ONck2Fxt8tG8InQNue9WeXZjGi:tFObW+OyF8tPB5zjGi
Threatray 8'271 similar samples on MalwareBazaar
TLSH T1D4E48C68A156C89AF61F4372A0ECFFB013F271E3D1C9C65792A46285D7D9BD70E4028E
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13097/50/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0ce4d09ecefc799a (13 x Formbook, 9 x AgentTesla, 6 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9451b64c517dd1cdf73f9ea6e931e693.exe
Verdict:
Malicious activity
Analysis date:
2022-11-10 12:34:23 UTC
Tags:
evasion trojan snake keylogger
Link:
https://app.any.run/tasks/414382f8-6595-448d-b991-70508f4ee550

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/331921/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed rundll32.exe
Link:
https://www.filescan.io/uploads/636cefbb7662ecf108398fd0/reports/2d80c0bb-7343-4f27-bf08-6667f2a83bd6/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/088192db-d12c-47b0-ad71-1d52d4acb3d9
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1110379
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-10 12:34:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
62
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cj3nneurxel26vnjs2w7a7ibk43zw6x2ej6vdux7q3koayyrv7wq._file
Verdict:
malicious
Similar samples:
0cca0bbeb38310bde6f3585ef3d5aa0d45f750851182590231fb7f7d85d2eee6
SnakeKeylogger
2bf3189c9ee98121b1a5b2746f3a46a141990a68ddfa8145ab08b347c6d66502
SnakeKeylogger
480e6eafca7220040b5c881ba63412843e888fb54e21b158a2568bec0cce0acf
SnakeKeylogger
6897412732ce8f38317aefff9c2bb19b15a91caccb0922c53fe29c36474de665
SnakeKeylogger
c1bff6750d2e97e236ec9af546da99de586e947375ca5b70f2004805786eb262
SnakeKeylogger
fa6901852ed9fd26b1adf6140ea9f8fe498edcf73f6b2350f825c10d71783a15
SnakeKeylogger
+ 8'261 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221110-prskhsbgfj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9fcff9d2-a4c2-4e4f-a877-46864944aa20
Unpacked files
SH256 hash:
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
MD5 hash:
21246cfe0f90ff27085d76afa64244c2
SHA1 hash:
f76247ed2d0fdbd4496e3969cfcf6d457cc61fa1
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/28a8ac09-ec11-408e-bfc7-c8cf36090d0c/
Parent samples :
0a2309336014e8ef72f8e8bcb41902b3c7e56f5c8afa477fda99b1e4f57bb852
0f6df37b515f330df516df24a8023025514d88fea9371ff96491003dffdc9b09
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
f0579298f475e4a98ec491ff10dc3bbab6ceac3b4f376a297ae03d36c177a09d
521e9db681ade0e368a3e99d735333c0d18df6087aa1f2fe6984c84ce1e4a1d8
a3465cca56d61a376078e6ac2d7466fae46bf7d073b9145b768f77ff33a3da0d
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
2afad9ad588a3219b1b36b0096ff4a8db8d70082fd09a612dc6f5935e46f0d4b
73237e3aa90060dbd999b15b39d48db44b63a5d23fd9b2c279fc97cd43a862fe
4832ccbb9379c4046a7478c3cba20a47cb978f37f11ace9afe0d8adb73e17003
9187704232908ac59df2c41f8129eb02fd895817abbce1c6d961a8024ebeb092
6fd62542f92cfcd09af0b2ad8f007a9dc110d64c16cfaab24a9ffd6552a754e8
178f92100449f71a893b39f99b0b3b434d54bd2b2833aaefeb0ab4415f7fb713
df757778956e59dda13ed21877d89a7b55902f285c5958d248300e2e9cfffb83
552b11b82396419c3efd98ecb70657b2d7652d061bbd5d626e478812a65925ee
7b3466885a3f5a38211cd4b6991a384b4a9d8747d5498f4762183e2a48a7fd23
ed31c7e7fc9f786ba9afc2d2885da4db73c4cef7c4514ce69089f57732f5b1ae
68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f
c8b129ddf3b6fbe3a7fe51c48706375b0a3c90711fdbb0111e215076bbfeef58
78f1957ff80044cf3cee3e4efbedbb55f3b64814ed8804fd076822d4ffcbcb6a
17c4cd880779f7dc3b48f6a2e097770b8b078fcc25f06286874233b3fbcb5099
3c78d5139a49e3f81272c1c7e7eae14f22ed3f7e89b8675663a574153d803eef
875ec0c37d9c973142c00da42bb1b6b6e58115cf85ba0e4e231d7bed7df3b21e
fc994ac728ca7b5d34d00f167b331c187110c45d4911572adc1eb279eb158b00
6381387fc80de027985e11c349120a3ee36724617ccbd2fb67b2d72663f8f93e
18743d67309b9042dccd7fc9b27dfdf6860b11745831d891fb64142836e3fc77
1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
585d258b90d3d045c1bd5e5858cc174a51bb25a425612934cd7f167e9a5029af
45ee7fd677dda19356451ef24de0d55b3ccdb5b54c47b5b053a1cf7a280736dc
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd
5bbeb09102c0876fc3d18a31c5aefdfc6f42a4354422611bfefedba2d51da208
cb252bdd63776400aa0f5b41de8ea075a2acb0ef25bcbcc430adb2d356b9e751
489ceb676e0e15e5e5c277ccb679b4508c7ac746e36ec21d4c7d9a52f8f1c88b
SH256 hash:
f2d717d0e837ea0d82db74d57264a16933bf9700e37d988931e9399a4deb2760
MD5 hash:
2254a317f0d2663f733c674fc44f56bb
SHA1 hash:
84e73dbf600d5ece596e595899692163e73d5fbd
Link:
https://www.unpac.me/results/28a8ac09-ec11-408e-bfc7-c8cf36090d0c/
SH256 hash:
eec9a74c56d00d54ec803ae2125b7dfcc668790a7576287107d4694155a35178
MD5 hash:
ec52103728bb260f60a7bd69ad6685ce
SHA1 hash:
6a71872a7f755e110f0f379d4d48767b08c6e926
Link:
https://www.unpac.me/results/28a8ac09-ec11-408e-bfc7-c8cf36090d0c/
SH256 hash:
cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4
MD5 hash:
aabd0bdc81026ade6c57383f21d5c227
SHA1 hash:
4b26936bb8c03be6d7963184215a5ab594ecb765
Link:
https://www.unpac.me/results/28a8ac09-ec11-408e-bfc7-c8cf36090d0c/
SH256 hash:
ab19f28c700d64814b0c55df868c30dfb94e0a1f9fb6f7bca05bac6eb78a4e52
MD5 hash:
1f2a6c02dcf9aa00a28a5039fb5b8ce0
SHA1 hash:
1ef480867d39b98368af7586a8e6ba38c0c3893a
Link:
https://www.unpac.me/results/28a8ac09-ec11-408e-bfc7-c8cf36090d0c/
SH256 hash:
1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
MD5 hash:
9451b64c517dd1cdf73f9ea6e931e693
SHA1 hash:
7452d2d6765580c591ab921032bc42b3da9dc79d
Link:
https://www.unpac.me/results/28a8ac09-ec11-408e-bfc7-c8cf36090d0c/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1276d69291b9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2406010/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/331921/

Comments