MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 137fb0e24fd529a653dc39073e216fc0044ba9ddbb1515d34155b16f9848ce1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 137fb0e24fd529a653dc39073e216fc0044ba9ddbb1515d34155b16f9848ce1f
SHA3-384 hash: 1bfc7fc1996f0f29162c8dffc6e741a83b2920796c78d77d62324d0cda060c6143fa71558a41f57ec6f2d1a6561f64bc
SHA1 hash: c2016a35cfc534a4e47a664a5a869b25b642bd6b
MD5 hash: e2498fedf6968ce9cc7bc6269d32dd97
humanhash: comet-alabama-georgia-snake
File name:Introduction & Presentation Citi.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:596'992 bytes
First seen:2021-02-02 15:39:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:HmIeI5/DM5JjjQBCN0MZDQYAqXhlkwOp4D:z39DM5hjsCN0ucYAqxlkwOpW
Threatray 14 similar samples on MalwareBazaar
TLSH 4CC4BFB9E4418FA6C5E91B7E9B61362073F071B39A92C15F209031BF2A51BC489F3D5B
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: air.nseasy.com
Sending IP: 64.37.52.73
From: Elsy Joseph <ejoseph@citiswd.com>
Subject: RE:Introduction & Presentation Citi Solutions Freight Forwarding Pvt Ltd.. /// WCA MEMBER ID: 108180
Attachment: Introduction Presentation Citi.zip (contains "Introduction & Presentation Citi.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115176/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/596845
Signature
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/137fb0e24fd529a653dc39073e216fc0044ba9ddbb1515d34155b16f9848ce1f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 10:48:17 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cn73bysp2uu2mu64hedt4ilpyacexko5xmkrlu2bkwyw7gcizypq._file
Verdict:
unknown
Similar samples:
0c3d1e60a1f6caa8bc2c84704ccf93ff2096891b6b5693952f5417c5aa577ee1
SnakeKeylogger
12f55950dc52aa9e607fcc04d3d2d2a58689a7ad8c1adbf58d04ac0c452ed5c0
SnakeKeylogger
15e8538add4ab2c08d4706205118a0ed7cd9c969d030f8b9ca203a12b0623c78
SnakeKeylogger
47ffaf572157824fb5a40a2706bd72f3e0e43090c621c9d676031fd80bb35fe5
SnakeKeylogger
484f0ef144b32492e7e9fe36e92b69b336583fa925438d2e82409006dd534af7
SnakeKeylogger
5c490fcd927f87434dca860aa71947a31942bcabfed0adb27ab16a0fe1412fe1
SnakeKeylogger
71908b2defae460e3fef4b3275a66680bb518a59a8b0d740e61f063ff9eece45
SnakeKeylogger
d15fa8ff467270abc9ba8c36038c455d2ad1de137748a1cc886e5f148a3a3fd8
SnakeKeylogger
ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e
SnakeKeylogger
ee2d3399e07c48849e8df4415f583db278466f880353b26a5e66b03f99185af6
SnakeKeylogger
+ 4 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210202-flw4tmjjws/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Beds Protector Packer
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/0ce9cb99-c600-4432-81b6-500fc02bd3ae/
SH256 hash:
4a42b4142db5a19439040bedb2cb5228b1bd690588b35ecff197a474fc63cacf
MD5 hash:
ebd9ef9d8d7b63ef92f3c97a47e97d31
SHA1 hash:
3f4b9592dc7c9b75e342c8584faec0341907c8ae
Link:
https://www.unpac.me/results/0ce9cb99-c600-4432-81b6-500fc02bd3ae/
SH256 hash:
f01701516a91d5ef62f58f52d49ee06f5f2edde19ec54bf3d49baceb173124d4
MD5 hash:
4150189aaf4246cf9386a047c6367bd9
SHA1 hash:
18ab0cf518cc95745a0cf4ac7235358193be97bd
Link:
https://www.unpac.me/results/0ce9cb99-c600-4432-81b6-500fc02bd3ae/
SH256 hash:
137fb0e24fd529a653dc39073e216fc0044ba9ddbb1515d34155b16f9848ce1f
MD5 hash:
e2498fedf6968ce9cc7bc6269d32dd97
SHA1 hash:
c2016a35cfc534a4e47a664a5a869b25b642bd6b
Link:
https://www.unpac.me/results/0ce9cb99-c600-4432-81b6-500fc02bd3ae/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/137fb0e24fd529a653dc39073e216fc0044ba9ddbb1515d34155b16f9848ce1f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip a3d48b488125eea685a55727b665951584ffa5f0d3e9c3fab2d3269994b5a440

SnakeKeylogger

Executable exe 137fb0e24fd529a653dc39073e216fc0044ba9ddbb1515d34155b16f9848ce1f

(this sample)

  
Dropped by
MD5 dc2dbedcb604a0651ba8ffb209b43d75
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/115176/
  
Dropped by
SHA256 a3d48b488125eea685a55727b665951584ffa5f0d3e9c3fab2d3269994b5a440

Comments