MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
SHA3-384 hash: 3474217898051c1d2c662f9c9eb43c482681b8942018151626057fa390be76bda714d70049f2032afb315dbd879916b6
SHA1 hash: 90c97c37a4409d12b8cb694ecc09271f6cf934da
MD5 hash: 8d98e6665b0caf0cff7a6218bc77cd7b
humanhash: oklahoma-comet-massachusetts-lamp
File name:unicaja-banco-26-0702023.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:602'112 bytes
First seen:2023-07-27 10:10:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:mYQQrpS2iNtOS92UFAtydcHJlkLsSxlsdhiBBfmvm:tQQrpS1nHAtULsSxW4U
Threatray 5'529 similar samples on MalwareBazaar
TLSH T1E4D4D090B1BD5FAAD577E7FB1511A20047F6A87E626DE31A4DC670CF21A0F014A01FAB
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
unicaja-banco-26-0702023.exe
Verdict:
Malicious activity
Analysis date:
2023-07-27 10:11:05 UTC
Tags:
evasion snake keylogger trojan
Link:
https://app.any.run/tasks/818c9531-a206-4c50-ba13-f47d3c8f64d3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/434734/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Sending an HTTP GET request
Enabling the 'hidden' option for analyzed file
Reading critical registry keys
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64c242b879f59a4bdc0c9596/reports/3a0e4413-463f-44ae-8d07-3848f8674a6c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/726dc289-0598-4998-8430-a3aa3cfcf749
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1281032
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-07-27 10:11:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cs6ds26ffvb7fy3qustfvufqqajojcygitwwmmsyjdqnv7izltsa._file
Verdict:
malicious
Similar samples:
045b8d75d54e46b8273a4cc1329a7c6fceb6c61417d36a08bc528e9e90cb8c05
SnakeKeylogger
1a1c58b80969ae187cde83fd32586d6072f8b66eae0dd3ae81c7b0d015d5c308
SnakeKeylogger
67b83f99148222c9f37d12f50c62096d2a16f6cca0e6217eb7654ebd152caac2
SnakeKeylogger
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
SnakeKeylogger
9b481ce4b3cb66b4325b09a71c65f202b2da68b1cc9f04cbfd5ad2043cd9ddee
SnakeKeylogger
c4c920d6d5d253db092a28210596c60b4377224251c3d14c4558a54346a71b75
SnakeKeylogger
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
SnakeKeylogger
d2ed2fe66a89a05c02510dabf4360f8fe54f6f27e94ccd864c56beaf218229e3
SnakeKeylogger
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
SnakeKeylogger
+ 5'519 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230727-l7xydsdh99/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
862f3cd524b29fc5b6ced9cfc4d13756cb90d6c95ca50fd2438e2d5df44bbf05
MD5 hash:
8ade068b8a62b6173f1d3e07bf0a7e04
SHA1 hash:
b63b1dddf4358e8826dab84e4206137d41718592
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/4cd15931-7ef9-4b90-a776-ad77e15cbdce/
Parent samples :
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
d2ed2fe66a89a05c02510dabf4360f8fe54f6f27e94ccd864c56beaf218229e3
14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059
d757716097082fdcf35033613d1736f4cf02f07afb368b1381489ba8ebba3cb0
48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/4cd15931-7ef9-4b90-a776-ad77e15cbdce/
SH256 hash:
de602af8567451d36663e614c9c3c9e6832ccdf05d5198bde70da8c70fee7e95
MD5 hash:
6a05e1d50305a84f1b6770eab42a5887
SHA1 hash:
29436ac946bd38f89077171a87591a43057cb62f
Link:
https://www.unpac.me/results/4cd15931-7ef9-4b90-a776-ad77e15cbdce/
SH256 hash:
a0b9aabe376fa88cd49144e9aa1cf8d915f5191f61334f72c648fe99c09d810d
MD5 hash:
d086ed782f92de43f8d02a60ad2d1dda
SHA1 hash:
0b4bf2e230c20d868f66f24b8b8fd4c5f67370cb
Link:
https://www.unpac.me/results/4cd15931-7ef9-4b90-a776-ad77e15cbdce/
SH256 hash:
14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
MD5 hash:
8d98e6665b0caf0cff7a6218bc77cd7b
SHA1 hash:
90c97c37a4409d12b8cb694ecc09271f6cf934da
Link:
https://www.unpac.me/results/4cd15931-7ef9-4b90-a776-ad77e15cbdce/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/14bc396bc52d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/434734/

Comments