MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1812c3277ccac3444894057b94558c452df3331202279a65bc5200048a003b3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1812c3277ccac3444894057b94558c452df3331202279a65bc5200048a003b3f
SHA3-384 hash: 740835f1f043d718da180fde1dcd844e2e0990daaa74be2b4f3204a2469566809da86c0abaae0b8c927b13da493ec049
SHA1 hash: 1d0c76b27d4ea89bdf7ea47ee8c3dfe471ae82ed
MD5 hash: 03c1b222e9f3d90eb2ce65ad841d54bc
humanhash: three-oxygen-charlie-indigo
File name:PAYMENT SLIP.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:797'696 bytes
First seen:2023-06-10 10:04:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:rMpeQHlWxMiQW/O4ue77bN5pszSEFsPq/Cj:8PlYMiQWmS77bLYFsPqM
TLSH T11905F11822FADB19E47A7FF808D0A07047F5A15A7152E74A4ED378DE6E70F418F0299B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon e08c0f2322073bc0 (10 x AgentTesla, 6 x Formbook, 3 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PAYMENT SLIP.exe
Verdict:
Malicious activity
Analysis date:
2023-06-10 10:05:17 UTC
Tags:
evasion snake keylogger trojan
Link:
https://app.any.run/tasks/07d6df24-9280-40c4-98fd-c008a8f34bfb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/397530/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67387251.17063.18751.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Forced shutdown of a browser
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/64844ad47f9fae00483aceef/reports/2b3c69ae-def2-455c-9c24-fcc7087bdfd4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/1812c3277ccac3444894057b94558c452df3331202279a65bc5200048a003b3f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cfeb8806-8160-4084-b43e-0a01634cc320
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1252334
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1812c3277ccac3444894057b94558c452df3331202279a65bc5200048a003b3f/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2023-06-05 16:34:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dajmgj34zlbuiseuav5zivmmiuw7gmysaitzuzn4kiaajcqahm7q._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230610-l4hpasfd2x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/c8a35318-ad9b-4f21-be93-2cf760f99fb4/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/c8a35318-ad9b-4f21-be93-2cf760f99fb4/
SH256 hash:
735e81f239156e21fd28dc1df800fc835c6eff96142788e095dca94c9bc44d5f
MD5 hash:
676fea6658fe88ee7078d11dfc326968
SHA1 hash:
a3771329478752246157a84c4d44876722bcd992
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/c8a35318-ad9b-4f21-be93-2cf760f99fb4/
Parent samples :
3a0e48b59320e5d800ec6026993ee87ae2b61971d41b4dcb44d856ef1afaa958
f481d6e8b3ce13572fb8fc54ea0204497350dcdad12e06d2e47afc04ab02d5f4
9901b6b09b65e36a881dcebc20d5dffa8e70f1258fefa766566f3e17614d7f08
1812c3277ccac3444894057b94558c452df3331202279a65bc5200048a003b3f
SH256 hash:
cade454c6f8012855e262f861dc779595590505b4ca7968d03d742861d5d3bcc
MD5 hash:
edec47b99d0868ea6a0d6ce6e378ea0e
SHA1 hash:
613ebad34163b62be06b6dfba5502d59daa6738a
Link:
https://www.unpac.me/results/c8a35318-ad9b-4f21-be93-2cf760f99fb4/
SH256 hash:
171263d045bcfe84511f1d0e40192221e5c11dcf85796fc3b389ed3b83239fa3
MD5 hash:
9508a1e1a68c7e6903781705000a642f
SHA1 hash:
54c61f3a02fa30affc866b49370707b855489934
Link:
https://www.unpac.me/results/c8a35318-ad9b-4f21-be93-2cf760f99fb4/
SH256 hash:
1812c3277ccac3444894057b94558c452df3331202279a65bc5200048a003b3f
MD5 hash:
03c1b222e9f3d90eb2ce65ad841d54bc
SHA1 hash:
1d0c76b27d4ea89bdf7ea47ee8c3dfe471ae82ed
Link:
https://www.unpac.me/results/c8a35318-ad9b-4f21-be93-2cf760f99fb4/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1812c3277cca/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/1812c3277ccac3444894057b94558c452df3331202279a65bc5200048a003b3f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/397530/

Comments