MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2
SHA3-384 hash: 92a438fc790b9ce444320277ce0430197a55b4f50ed61dc8a38401ea28b4905763b8291cb873163e427f59285320d1fc
SHA1 hash: d150c271d6f938f5c7eccb6aabca440be51aa08f
MD5 hash: 80d0f1025f6f424223497f7be1612a69
humanhash: diet-four-cardinal-red
File name:Img-347654566091236.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:421'708 bytes
First seen:2021-06-18 13:00:47 UTC
Last seen:2021-06-18 13:56:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:RBlL/ZuDA1+3+AuF7ac88JTFlnwyE1+6kaLKzoOcE50RNjS4jrmP2bVdd+dX:3zgA03jgdTFlqoraL6jcEiRZjrmPH
Threatray 219 similar samples on MalwareBazaar
TLSH 4F948DF16780C465D8A796B9883BDAA7B433A24E9C68490D3D91FF0F7D72347402789B
Reporter TeamDreier
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Img-347654566091236.exe
Verdict:
Malicious activity
Analysis date:
2021-06-18 13:05:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b06a0888-af1b-47de-a932-a419b2682f65

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/166849/
Detection(s):
SecuriteInfo.com.Trojan.Loader.838.17088.20259.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/34540810-a325-4642-ac42-d52a50e11172
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/804338
Signature
.NET source code references suspicious native API functions
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal WLAN passwords
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 436749 Sample: Img-347654566091236.exe Startdate: 18/06/2021 Architecture: WINDOWS Score: 100 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Sigma detected: Capture Wi-Fi password 2->67 69 6 other signatures 2->69 8 Img-347654566091236.exe 1 21 2->8         started        12 sbgmyrwcgvh.exe 17 2->12         started        14 sbgmyrwcgvh.exe 17 2->14         started        process3 dnsIp4 39 C:\Users\user\AppData\...\sbgmyrwcgvh.exe, PE32 8->39 dropped 41 C:\Users\user\AppData\Local\...\System.dll, PE32 8->41 dropped 83 Writes to foreign memory regions 8->83 85 Maps a DLL or memory area into another process 8->85 17 MSBuild.exe 15 4 8->17         started        43 C:\Users\user\AppData\Local\...\System.dll, PE32 12->43 dropped 21 MSBuild.exe 4 12->21         started        61 192.168.2.1 unknown unknown 14->61 45 C:\Users\user\AppData\Local\...\System.dll, PE32 14->45 dropped 87 Multi AV Scanner detection for dropped file 14->87 89 Machine Learning detection for dropped file 14->89 23 MSBuild.exe 4 14->23         started        file5 signatures6 process7 dnsIp8 47 smtp.azebal.com 17->47 49 checkip.dyndns.org 17->49 57 3 other IPs or domains 17->57 71 May check the online IP address of the machine 17->71 73 Uses netsh to modify the Windows network and firewall settings 17->73 75 Tries to harvest and steal WLAN passwords 17->75 25 netsh.exe 3 17->25         started        51 smtp.azebal.com 21->51 53 checkip.dyndns.org 21->53 77 Tries to steal Mail credentials (via file access) 21->77 79 Tries to harvest and steal ftp login credentials 21->79 81 Tries to harvest and steal browser information (history, passwords, etc) 21->81 27 netsh.exe 21->27         started        55 smtp.azebal.com 23->55 59 2 other IPs or domains 23->59 29 netsh.exe 3 23->29         started        signatures9 process10 process11 31 conhost.exe 25->31         started        33 conhost.exe 27->33         started        35 conhost.exe 27->35         started        37 conhost.exe 29->37         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-06-18 01:29:54 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1e887de55218e7c4b732111000db7e51d98018d01f89fadae675a4f12e964970
SnakeKeylogger
2a487a298c66cdb24fc08767e26dfaef11d3d3bd043997c7984e80052a7bfd89
SnakeKeylogger
57bcdee4cc181db0c6671ccdd70a978bc4fa752bd6bfc9557be713539127baee
SnakeKeylogger
7320b115d96ae0e50fe44d8600bd0bd68e2fac3bb4604f8f333f04e247c301bd
SnakeKeylogger
93cae28d3ae17b560c738e38d6ff788924bb515c1312d39f5122041dcc79a114
SnakeKeylogger
ab74bc0055021acfabe6b05c55f5dd39ba805c770825ca887c1ac6c135f4bd99
SnakeKeylogger
bdbba0c991f70ccddad27da903e5e689a6e762ac23ab78ffea10f389f55045c3
SnakeKeylogger
c751f9d546d20216bdc996ecdcea6ee9f57771682879383621bff83a8229e384
SnakeKeylogger
d09500f30f90dcdf6caac545bff9663876dc3a7de445d618e947ba64a5f4966b
SnakeKeylogger
e8bc94b0faea9886f1fa39e0e9f609f2f266b3d7d812faad4b2ae9904b170b00
SnakeKeylogger
+ 209 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/210618-f8kvx3alde/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Unpacked files
SH256 hash:
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 hash:
56a321bd011112ec5d8a32b2f6fd3231
SHA1 hash:
df20e3a35a1636de64df5290ae5e4e7572447f78
Link:
https://www.unpac.me/results/3a466952-1de9-4bc0-9ace-2062b3e10ada/
SH256 hash:
afa2538fbd852018bf6690d6064a79cf7211f90ae2e1f5f7daa20edcdd20d1ee
MD5 hash:
fec00b0f0bff991811687228c4234a7b
SHA1 hash:
30fbcd1698a3d0e9448f1c22989d9b5afb72b907
Link:
https://www.unpac.me/results/3a466952-1de9-4bc0-9ace-2062b3e10ada/
SH256 hash:
19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2
MD5 hash:
80d0f1025f6f424223497f7be1612a69
SHA1 hash:
d150c271d6f938f5c7eccb6aabca440be51aa08f
Link:
https://www.unpac.me/results/3a466952-1de9-4bc0-9ace-2062b3e10ada/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Choice_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_RANSOM_COVID19_Apr20_1
Create hunting rule
Author:Florian Roth
Description:Detects ransomware distributed in COVID-19 theme
Reference:https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/
Rule name:pe_imphash
Create hunting rule
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_bot_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/166849/

Comments