MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285
SHA3-384 hash: 2580be7b4b7cbc96adb2f1b12a3a99c5d136c9d6b65c35900757757df26bda06f0600ea1e675b4f10f87e0ce716809f5
SHA1 hash: 29deb9a6282aca784e1c31d734f55971e30eb4a7
MD5 hash: c361028b8a49cb6686572effc5f18bc5
humanhash: robin-uniform-whiskey-comet
File name:MT103 Halkbank,pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:848'896 bytes
First seen:2023-03-08 12:21:55 UTC
Last seen:2023-03-08 13:01:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:ya/5u62iNbJql+x4lGcpRZL9vQz0/Jm0q3cpwa7RQ98UJ6bx:ya/5u61tkl+xIR5pvP00qM3O9hJux
Threatray 4'527 similar samples on MalwareBazaar
TLSH T11A05CF5972B15463FC8F41BA192BF29C2D7171433365E23B5B3B3AE1E6119BFB288601
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 00f0f4f4eca43600 (5 x Loki, 5 x SnakeKeylogger, 5 x AgentTesla)
Reporter cocaman
Tags:exe Shipping SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MT103 Halkbank,pdf.exe
Verdict:
Suspicious activity
Analysis date:
2023-03-08 12:22:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6e7996cb-631e-4b03-813c-a8704915979a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/372559/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64087dedecb98d101063f4bb/reports/daf6febc-684d-4b15-b906-16e0dec306ce/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a4969c0c-7cf7-4498-be35-c34a3ae537a2
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1189402
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2023-03-08 04:48:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dd2vvfc25a7rlr26wsdp6g7ulrbdxlcp46vypiujqrffdap3ykcq._file
Verdict:
malicious
Similar samples:
46c067d4021f6ec8d8cc8cf5211e05c860e857bfabe5e0265f9ea6914f1722ef
SnakeKeylogger
4b217e79d0c538d6d0e711f20df8ce47dcbb1104d5f4ad7634a4ed70ad0a34ef
SnakeKeylogger
4cfe382fc05866c2087a5d003050a40fb1a1789f8547bd13956e8823d8cf61f8
SnakeKeylogger
695e823587b2441ca95f76514ec7745ff78bf8dc5b3e153ca63e7d7a11d1a4f5
SnakeKeylogger
79aed49f0c68c31e73f828fe6796a1fbaff39a50e79e14c4d8436d57ecac944b
SnakeKeylogger
91855c7204cf7b1a4a56e87b16e5cde14eb8aba073690ca817f2b937130135d6
SnakeKeylogger
d10d4cd425dfc56bcf1234088ab4310960b104099961f3cf343c1f76acf54669
SnakeKeylogger
+ 4'517 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230308-pjw8qsfg3t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
c11db2849ea210ffcb6b52298eb14d8101d708741bfe5dde466733b356286dfe
MD5 hash:
624499dcece39eb220bf52b9a38f99cf
SHA1 hash:
ed9a5b547831859e82ad1bd06df4f306feff8500
Link:
https://www.unpac.me/results/9e151e50-18fc-4535-aea9-2d79ed949763/
SH256 hash:
dd49948e0b3393a8b53084075ec2f2a8c36813d1ba1ca538697eb62ec4b4deae
MD5 hash:
538dab51e58b7dd3809664982f4d0746
SHA1 hash:
4e7f9615f1d96b087c453a72217662f867e0520d
Link:
https://www.unpac.me/results/9e151e50-18fc-4535-aea9-2d79ed949763/
SH256 hash:
5331f0cbdcb21d6477e6bab565c9f51ceb784b6d4f32ab5289e9c6d165bd3a5c
MD5 hash:
2caf5554286fee51168127da9d1bf3ae
SHA1 hash:
4364443052545b1539f632c81657d0185540db42
Link:
https://www.unpac.me/results/9e151e50-18fc-4535-aea9-2d79ed949763/
SH256 hash:
edaffa1d470e142eceafab1372717b8f568f25ccd849aefe4631b7b1da4be3e2
MD5 hash:
e00d70e1b23928b3f217699c58931eaf
SHA1 hash:
252fbd19c76e0ce9c9d4dbb7bedd9e943dfbb2c6
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/9e151e50-18fc-4535-aea9-2d79ed949763/
Parent samples :
91855c7204cf7b1a4a56e87b16e5cde14eb8aba073690ca817f2b937130135d6
7a43e50091e1f6a5a80e4e3b2f246a067f94ff7e85067ee9f98e11225fbbfa9f
18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285
SH256 hash:
8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c
MD5 hash:
e5b073b30db1b058298f5df032164e4d
SHA1 hash:
15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca
Link:
https://www.unpac.me/results/9e151e50-18fc-4535-aea9-2d79ed949763/
SH256 hash:
18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285
MD5 hash:
c361028b8a49cb6686572effc5f18bc5
SHA1 hash:
29deb9a6282aca784e1c31d734f55971e30eb4a7
Link:
https://www.unpac.me/results/9e151e50-18fc-4535-aea9-2d79ed949763/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/18f55a945ae8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 93d96bbf21e47a499496602a45728d358dbe44a9130e2b3b1aa2822e8f8532bf

SnakeKeylogger

Executable exe 18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 93d96bbf21e47a499496602a45728d358dbe44a9130e2b3b1aa2822e8f8532bf
Cape
Cape
https://www.capesandbox.com/analysis/372559/
  
Dropped by
SHA256 dd4622f9700567fdf92c4710ac0bd4bb44edab73aec5f40339c6160b6bff1de5
  
Dropped by
MD5 ce30147aed92a20e3e1a9ce3daa29f75
  
Dropped by
MD5 e0e497c2b1f8cfa0805de272f2f7d162

Comments