MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4
SHA3-384 hash: 0bfc29265433c81cddac6de0359d5e4bfeb26bf9e9957161a5a8fa557735a470fc641c1a4a2b9875fb69df146fd2ef2c
SHA1 hash: 9d51253d78450af8fc0d0c3c5397970375a31a55
MD5 hash: cf7a7dd2996e54c1e4877031902e3ac8
humanhash: juliet-uncle-september-network
File name:20987098000.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:308'170 bytes
First seen:2021-06-23 06:01:59 UTC
Last seen:2021-06-23 06:02:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:GBlL/bXarjjl8R3y0n9Px958nvXuAx4rZqQtB4dIH8Z3lui54Z22bNBV1X:EparO3yC3kPrM5MIo2H
Threatray 287 similar samples on MalwareBazaar
TLSH F0641248A2E16CE7D0D3077223BFA376E3789548281509975768EF6A7E335D3290A783
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
20987098000.exe
Verdict:
Malicious activity
Analysis date:
2021-06-23 06:02:47 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/4f332e8d-a3e8-4dd8-ac52-a19c4e012060

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167735/
Detection(s):
SecuriteInfo.com..16680.22658.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/38fa79f2-1491-4141-8c56-c88500c3890d
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806389
Signature
.NET source code references suspicious native API functions
Contains functionality to capture screen (.Net source)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 438800 Sample: 20987098000.exe Startdate: 23/06/2021 Architecture: WINDOWS Score: 100 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 4 other signatures 2->50 6 qffwuqweybs.exe 17 2->6         started        10 qffwuqweybs.exe 17 2->10         started        12 20987098000.exe 1 21 2->12         started        process3 file4 22 C:\Users\user\AppData\Local\Temp\xzkt, DOS 6->22 dropped 24 C:\Users\user\AppData\Local\...\System.dll, PE32 6->24 dropped 52 Writes to foreign memory regions 6->52 54 Maps a DLL or memory area into another process 6->54 14 MSBuild.exe 4 6->14         started        26 C:\Users\user\AppData\Local\...\System.dll, PE32 10->26 dropped 56 Multi AV Scanner detection for dropped file 10->56 58 Machine Learning detection for dropped file 10->58 18 MSBuild.exe 4 10->18         started        28 C:\Users\user\AppData\...\qffwuqweybs.exe, PE32 12->28 dropped 30 C:\Users\user\AppData\Local\...\System.dll, PE32 12->30 dropped 20 MSBuild.exe 15 4 12->20         started        signatures5 process6 dnsIp7 32 checkip.dyndns.org 14->32 60 Tries to steal Mail credentials (via file access) 14->60 62 Tries to harvest and steal ftp login credentials 14->62 64 Tries to harvest and steal browser information (history, passwords, etc) 14->64 34 checkip.dyndns.org 18->34 36 104.21.19.200, 443, 49755, 49758 CLOUDFLARENETUS United States 18->36 38 checkip.dyndns.org 20->38 40 checkip.dyndns.com 162.88.193.70, 49742, 49743, 49752 DYNDNSUS United States 20->40 42 freegeoip.app 172.67.188.154, 443, 49745 CLOUDFLARENETUS United States 20->42 66 May check the online IP address of the machine 20->66 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-06-23 04:22:36 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cl6xczd5bxoduvqzs5jir4yqarywf4jfq5s5gn7pv3sbdspx472a._file
Verdict:
malicious
Similar samples:
022e918d8b07b6bda3fc703e212db5d145fa5814f33ea2fa8a350e2be405a348
SnakeKeylogger
19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2
SnakeKeylogger
42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81
SnakeKeylogger
57bcdee4cc181db0c6671ccdd70a978bc4fa752bd6bfc9557be713539127baee
SnakeKeylogger
93cae28d3ae17b560c738e38d6ff788924bb515c1312d39f5122041dcc79a114
SnakeKeylogger
ab74bc0055021acfabe6b05c55f5dd39ba805c770825ca887c1ac6c135f4bd99
SnakeKeylogger
bdbba0c991f70ccddad27da903e5e689a6e762ac23ab78ffea10f389f55045c3
SnakeKeylogger
c751f9d546d20216bdc996ecdcea6ee9f57771682879383621bff83a8229e384
SnakeKeylogger
d09500f30f90dcdf6caac545bff9663876dc3a7de445d618e947ba64a5f4966b
SnakeKeylogger
e8bc94b0faea9886f1fa39e0e9f609f2f266b3d7d812faad4b2ae9904b170b00
SnakeKeylogger
+ 277 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210623-pckxa5pjes/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Unpacked files
SH256 hash:
049a3787d59652f29e40d7882abac625fded66dd5a20f61060e6910515a019f7
MD5 hash:
dbb8c873ebb0a95e9f7c83b5d68d6579
SHA1 hash:
ffd776a2b0cd82835f437a41602cd403823140db
Link:
https://www.unpac.me/results/ed002919-b3f3-4c8d-88e2-170b1969babe/
Parent samples :
932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14
6379623552f5d0965d8cfe83f3725942907a9b26766e3e6cb5e27258b1e120d9
SH256 hash:
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 hash:
56a321bd011112ec5d8a32b2f6fd3231
SHA1 hash:
df20e3a35a1636de64df5290ae5e4e7572447f78
Link:
https://www.unpac.me/results/ed002919-b3f3-4c8d-88e2-170b1969babe/
SH256 hash:
12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4
MD5 hash:
cf7a7dd2996e54c1e4877031902e3ac8
SHA1 hash:
9d51253d78450af8fc0d0c3c5397970375a31a55
Link:
https://www.unpac.me/results/ed002919-b3f3-4c8d-88e2-170b1969babe/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Choice_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_bot_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/167735/

Comments