MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1833ccd4e1eaabab8e62142df4a24963351c3a29eca19ce3455b5ad004d843a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 7
| SHA256 hash: | 1833ccd4e1eaabab8e62142df4a24963351c3a29eca19ce3455b5ad004d843a7 |
|---|---|
| SHA3-384 hash: | 90c6657584f9a346479f809b8bde749a772ead56d6e26e6cb9ec170f951bdf72fd669949bd8e80386ee8e2e87e4a008a |
| SHA1 hash: | 5849f9ed44c91573317a2b5b47f62384fec72b75 |
| MD5 hash: | db19fb75cfc8ba8ba9601635594bda08 |
| humanhash: | east-oven-arizona-paris |
| File name: | db19fb75cfc8ba8ba9601635594bda08.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 529'364 bytes |
| First seen: | 2021-09-22 08:50:57 UTC |
| Last seen: | 2021-09-22 10:03:53 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger) |
| ssdeep | 12288:FTUSUJ+9WZve8zvRKtvHGxOLEbGxjVWvftb7OCsOa:dUkW98ZHGxOQbahWx71S |
| Threatray | 1'093 similar samples on MalwareBazaar |
| TLSH | T17CB423424BA045E3C75B4B395BE1A16AF329CB165040AF0F6BDC1F1FABA70C7A15D6B0 |
| File icon (PE): |  |
| dhash icon | 64f4d4d4ecf4d4d4 (82 x SnakeKeylogger, 34 x AgentTesla, 24 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
db19fb75cfc8ba8ba9601635594bda08.exe
Verdict:
Malicious activity
Analysis date:
2021-09-22 08:52:28 UTC
Tags:
evasion trojan snakekeylogger keylogger
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal WLAN passwords
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2021-09-17 13:20:28 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'083 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Looks up external IP address via web service
Loads dropped DLL
Unpacked files
SH256 hash:
4a8080d6ebb136ce6b049f9fe7872e164b0266309f4ee8cb610b950b4df727df
MD5 hash:
35aa711c620fc22debb06e38cf761403
SHA1 hash:
7f49427a7f0ceafce19a6dd485ed6d71a0e986eb
SH256 hash:
23b8b2fa99a8b4c4148598d75552cccc86d856b49ca81eca67426d22f4312a4d
MD5 hash:
19eba9f55b173f883b422b927dc0845c
SHA1 hash:
e3f387287b15ae833ce9abee9a8bdaaad1e902be
SH256 hash:
1833ccd4e1eaabab8e62142df4a24963351c3a29eca19ce3455b5ad004d843a7
MD5 hash:
db19fb75cfc8ba8ba9601635594bda08
SHA1 hash:
5849f9ed44c91573317a2b5b47f62384fec72b75
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.