MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a2bcdeb48f63761b003373d932fc7eea4702ed9b856a69ae44d54a625424081. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a2bcdeb48f63761b003373d932fc7eea4702ed9b856a69ae44d54a625424081
SHA3-384 hash: f759f35261f1612715d9cd10b75f54c76cfcee8fd1c773e8b5c2d9f2583bd185cff7fa8d3fbcc4efaad562b97334c227
SHA1 hash: 959d4ecaf2a3a4fa4306e7cea852877da8af8726
MD5 hash: 7e9fcef984ed18d0677ad08fb0b1a03b
humanhash: zulu-connecticut-washington-yellow
File name:SecuriteInfo.com.Trojan.PWS.Siggen3.24449.11550.175
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:641'024 bytes
First seen:2022-11-16 14:51:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:1kKgxNUu/WCYGQNOZHpsYl10prnRyskdUpouTsQt8CQp41xdHhAo48rsswku:OKgcpCYrNOZHlGrnRedG7Tpt8C5Vov
Threatray 8'730 similar samples on MalwareBazaar
TLSH T11ED4192D79BCF412EF3BA9A70EE7AA4BCC301241121E91171D2937DEE93587A3D4D14A
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.PWS.Siggen3.24449.11550.175
Verdict:
Malicious activity
Analysis date:
2022-11-16 14:57:27 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/11ed2d39-45c0-4915-b405-e3645d9a29de

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/334879/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.24449.11550.175.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6374f9153024da3911e827ca/reports/82483c74-8cc1-4150-b42b-c0cb1eb31d09/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/be28010a-d0ba-45f1-a09b-ddd2de2b5851
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1114926
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 747622 Sample: SecuriteInfo.com.Trojan.PWS... Startdate: 16/11/2022 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Sigma detected: Scheduled temp file as task from temp location 2->53 55 9 other signatures 2->55 7 SecuriteInfo.com.Trojan.PWS.Siggen3.24449.11550.175.exe 7 2->7         started        11 gGyLWbVIuFtqvB.exe 5 2->11         started        process3 file4 33 C:\Users\user\AppData\...\gGyLWbVIuFtqvB.exe, PE32 7->33 dropped 35 C:\...\gGyLWbVIuFtqvB.exe:Zone.Identifier, ASCII 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmp1B18.tmp, XML 7->37 dropped 39 SecuriteInfo.com.T...9.11550.175.exe.log, ASCII 7->39 dropped 57 May check the online IP address of the machine 7->57 59 Uses schtasks.exe or at.exe to add and modify task schedules 7->59 61 Adds a directory exclusion to Windows Defender 7->61 13 SecuriteInfo.com.Trojan.PWS.Siggen3.24449.11550.175.exe 15 2 7->13         started        17 powershell.exe 21 7->17         started        19 schtasks.exe 1 7->19         started        63 Multi AV Scanner detection for dropped file 11->63 65 Machine Learning detection for dropped file 11->65 67 Injects a PE file into a foreign processes 11->67 21 gGyLWbVIuFtqvB.exe 2 11->21         started        23 schtasks.exe 1 11->23         started        25 gGyLWbVIuFtqvB.exe 11->25         started        signatures5 process6 dnsIp7 41 checkip.dyndns.com 132.226.8.169, 49702, 80 UTMEMUS United States 13->41 43 checkip.dyndns.org 13->43 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        45 193.122.6.168, 49703, 80 ORACLE-BMC-31898US United States 21->45 47 checkip.dyndns.org 21->47 69 Tries to steal Mail credentials (via file / registry access) 21->69 71 Tries to harvest and steal ftp login credentials 21->71 73 Tries to harvest and steal browser information (history, passwords, etc) 21->73 31 conhost.exe 23->31         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a2bcdeb48f63761b003373d932fc7eea4702ed9b856a69ae44d54a625424081/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-11-16 09:16:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 26 (76.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=div4322i6y3wdmadg46zgl6h52shalwzxblkngxejvkkmjkcicaq._file
Verdict:
malicious
Similar samples:
2f6e6357881973427aa992355125e2a7be58586613136a7fa4a84a49dd28dc93
SnakeKeylogger
3bd6eaf7910876056f5f594c6b15fd7a8b75c6eef0c0a76690ed49e72ea97366
SnakeKeylogger
44ef6929139229baffe966a8f2facca112903f143106b56b6afae3e0ae94276b
SnakeKeylogger
495c80adad64f20ab292f42de22850ba2abcc8f9a1c1eb41eda64088fd0bfaa8
SnakeKeylogger
4a2077c64b24049a2dfcfb0d2788d4160f1b21bdea9fa588ac69ed8fcd1ecd6e
SnakeKeylogger
4b28969cc4f30f407d15a6d462105ac3f164585ae720d35a8249bd5c91fc51d5
SnakeKeylogger
60af9df81cf538b49e2411b69acfbcd2df44edffa4c4912e16c64d2618d22a8c
SnakeKeylogger
c498b83c2623ae4b95259430d63e9ef264941ffa0bfb7a7005f3db8244a69707
SnakeKeylogger
cc83749270a1efd6c7ebeb1e3c077a426ec98f3b25e14e268dc18b17409abba9
SnakeKeylogger
+ 8'720 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221116-r8p7tsfg2z/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0b8b55bb-0e95-4836-ad68-0963e93eabee
Unpacked files
SH256 hash:
71fc5637ab5f8a6a915406975abf06bc54869ceff16d048523df8ae819815587
MD5 hash:
3c654d6bc0e38e13c5588a12573e1672
SHA1 hash:
d12e79c715ab2e69426c476bc22ee81f27d265e2
Link:
https://www.unpac.me/results/b81e66a9-f4fe-49af-b6a6-787046ed50ce/
SH256 hash:
803ac55239281a2aee3fc136e1f0ed8f40816976be67d178454d1a2be0234fc4
MD5 hash:
83589dbfe0f98981ac09cc97214b3ca6
SHA1 hash:
81eecb86c630accd52358a1173def2a410e77697
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/b81e66a9-f4fe-49af-b6a6-787046ed50ce/
Parent samples :
1a2bcdeb48f63761b003373d932fc7eea4702ed9b856a69ae44d54a625424081
51b45d11cba45d30496c8449e6dee487307480f2c8f6f3ef9f306e5ac72ae26a
0966d22c10cfc51a945ce9ed922b4422c9bcb4187990a474b285fd18fe7e88e4
4542f3e10ba41a195791bce25b8093e5d984649c48a10abafee51ff95e44e8fe
394b55b4f46506a0d758e7edc401fd6474c6a271c64aea476ed3c13c5c1568cb
SH256 hash:
0b0d9770db20440852a567fdcc5d42dea88e40352bf26b1b053ffa57ec18d8e3
MD5 hash:
5ed3d7838c9b3a4805d37d9f01fb294d
SHA1 hash:
661839cc871bf7486e6f4c48ffd5e072cf3c82be
Link:
https://www.unpac.me/results/b81e66a9-f4fe-49af-b6a6-787046ed50ce/
SH256 hash:
cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4
MD5 hash:
aabd0bdc81026ade6c57383f21d5c227
SHA1 hash:
4b26936bb8c03be6d7963184215a5ab594ecb765
Link:
https://www.unpac.me/results/b81e66a9-f4fe-49af-b6a6-787046ed50ce/
SH256 hash:
ab19f28c700d64814b0c55df868c30dfb94e0a1f9fb6f7bca05bac6eb78a4e52
MD5 hash:
1f2a6c02dcf9aa00a28a5039fb5b8ce0
SHA1 hash:
1ef480867d39b98368af7586a8e6ba38c0c3893a
Link:
https://www.unpac.me/results/b81e66a9-f4fe-49af-b6a6-787046ed50ce/
SH256 hash:
1a2bcdeb48f63761b003373d932fc7eea4702ed9b856a69ae44d54a625424081
MD5 hash:
7e9fcef984ed18d0677ad08fb0b1a03b
SHA1 hash:
959d4ecaf2a3a4fa4306e7cea852877da8af8726
Link:
https://www.unpac.me/results/b81e66a9-f4fe-49af-b6a6-787046ed50ce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1a2bcdeb48f63761b003373d932fc7eea4702ed9b856a69ae44d54a625424081

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/334879/

Comments