MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90
SHA3-384 hash: 7845fdc448fb22fc4dd8625fa0efe8737686d52c9848d9e52927a0a422a7d061e56a8f2c500b75a1b90202f8b9a7d1b2
SHA1 hash: 346883500a8a00ea0c05cb030aee34972b81c435
MD5 hash: e50771bb8339029c56648778441e0bd2
humanhash: steak-two-sixteen-december
File name:15-0209.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:600'576 bytes
First seen:2023-08-15 12:18:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:1y53bV/OGTSjH7poaXBeMdhjBNhi9+GO7/CCyWubLkPS7X+fXzWVY:1yWGTSHpoaIMGnlvhb+fC
Threatray 5 similar samples on MalwareBazaar
TLSH T178D41309B2FD2B46C0FEE3F7B626A865077479EB0961E25C6DA131DB2A30F454681F07
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
284
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
15-0209.exe
Verdict:
Malicious activity
Analysis date:
2023-08-15 12:24:51 UTC
Tags:
evasion snake keylogger trojan
Link:
https://app.any.run/tasks/af4b64eb-64b0-4e3b-9006-30ba1d06679e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/442769/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4e2caba7-f90b-44a4-b4c4-4e149fbe552e
Result
Threat name:
RedLine, Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1291387
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected RedLine Stealer
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
404keylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-08-15 11:50:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=czk52famuzh3xorg7lc4mmdsynrmcyjwd7mmgom3kt6v4ftgxsia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
30648c0ee182936cffc123c0d03094be35f5cd6fcc246c2d173d649c2b68f132
SnakeKeylogger
716d70fd423743ee627af65200138b848659e7f307d12181c07988640d10d5bd
SnakeKeylogger
7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a
SnakeKeylogger
d00f8dee3e81decbb37ef2651c88d3ba46a959d5bfe1d71fc17afd8b4704b4bd
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/230815-pg7axsce8y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Uses the VBS compiler for execution
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
ce1ceaa49add2aff90bccd5af49ebe1f70f69bc67174300a7eb29bccd01f60ae
MD5 hash:
462ba946ea64fdd27b39be8b7adb4db9
SHA1 hash:
a441ba9aaa05d55ad709905df9dcdfb937143af9
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/77041dc6-8d3b-4b78-b01a-ddbcb81e070c/
Parent samples :
d00f8dee3e81decbb37ef2651c88d3ba46a959d5bfe1d71fc17afd8b4704b4bd
7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a
30648c0ee182936cffc123c0d03094be35f5cd6fcc246c2d173d649c2b68f132
1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90
SH256 hash:
f9897e0f26950b3d7d986b24cdead0d069f0d1054298b5c72c59bd20313e4560
MD5 hash:
4f5662b936f0a5ded5bc3d129cdb8276
SHA1 hash:
096da292f55bd9a71ead7568aa123dd1f028437c
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/77041dc6-8d3b-4b78-b01a-ddbcb81e070c/
Parent samples :
30648c0ee182936cffc123c0d03094be35f5cd6fcc246c2d173d649c2b68f132
1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90
SH256 hash:
d49b6b98ce2072303df26f7fdd3bcf642267bd4d44be0bbbfabf7e9742618dd8
MD5 hash:
9668fa7d79bba30a0080007d155a5bd4
SHA1 hash:
c3df87d81ec44a86f03d12e8184fd9d8f2365233
Link:
https://www.unpac.me/results/77041dc6-8d3b-4b78-b01a-ddbcb81e070c/
SH256 hash:
2ac2f55e15fd8da559f99925ceee9166ca978e94cbc53a5cb29bf02d0a76ac7f
MD5 hash:
1081db0b25581c7958e6fbff4d9aa64a
SHA1 hash:
bcb0e0fe844884a5b0d05cd3b0cc5fd7a5ff53b9
Link:
https://www.unpac.me/results/77041dc6-8d3b-4b78-b01a-ddbcb81e070c/
SH256 hash:
ff87a0b9294d15a55a911a3ba6723392627773cfe7c70d899e1becf52554ecf3
MD5 hash:
f52fb00fb4bf99f2a1134238e7edd947
SHA1 hash:
a2a87d002f33762b6b46023bdd6f3e783ee03c29
Link:
https://www.unpac.me/results/77041dc6-8d3b-4b78-b01a-ddbcb81e070c/
SH256 hash:
e1333a1d5d28839e1e740aef42f53c21488a6f821874b27f4540e04830098af4
MD5 hash:
ee43618c6e0e8ce311be20d5e5d7a7bc
SHA1 hash:
31bf3843e538d439d269664260688f950ecb6668
Link:
https://www.unpac.me/results/77041dc6-8d3b-4b78-b01a-ddbcb81e070c/
SH256 hash:
1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90
MD5 hash:
e50771bb8339029c56648778441e0bd2
SHA1 hash:
346883500a8a00ea0c05cb030aee34972b81c435
Link:
https://www.unpac.me/results/77041dc6-8d3b-4b78-b01a-ddbcb81e070c/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1655dd140ca6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/442769/

Comments