MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1
SHA3-384 hash: f99a942803dcc15b3534515700185cfefbfa869150f826aca68f8876a26665848d7d9d5c8bcd9686f74d9e0e310e292d
SHA1 hash: 3af94de8f4160c3278fec523c63edaf3ddb70960
MD5 hash: fc6a61ebe3359d87aee1b2759fd51fbd
humanhash: oklahoma-pluto-wolfram-winter
File name:QUOTATION 1309-RFQ.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:917'504 bytes
First seen:2022-10-06 09:18:42 UTC
Last seen:2022-10-06 18:54:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:DHNo+n1juZHG3fAilIdvDpdS9XAPajwSVm5ZXlTF1qffaR/4ve:xLoFNzS9QPek5Z1TF1UI4ve
Threatray 5'662 similar samples on MalwareBazaar
TLSH T15A15CF3207E6D60BD01A1338CDE2D3F06FE85EA5E5B2C7474FE9BC6BB5070A6AA41544
TrID 49.6% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
21.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.9% (.SCR) Windows screen saver (13101/52/3)
7.1% (.EXE) Win64 Executable (generic) (10523/12/4)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon ec82e8e8eab2ced8 (17 x SnakeKeylogger, 9 x Loki, 9 x AgentTesla)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
10
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/317195/
Detection(s):
Sanesecurity.Rogue.0hr.20221006-1240.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Launching a process
Creating a file
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633e9d8b49c58ce767c6572e/reports/afd03a2f-0f53-4b66-bfe4-c72410e2b6d5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a6e56612-82ae-4538-9cb2-4ecb04475668
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1085262
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-06 04:51:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=djjhuvthgwtteeq7iatsimamyo2zk52ftwancj2dgvsljopmuwqq._file
Verdict:
malicious
Similar samples:
2d4807b948984f8b7f170d662a8c055f53420770e82428a9315001d3d420d610
SnakeKeylogger
50da774fda04ec1034035862f80ea8933397e34b66ac58c239c369836e341be0
SnakeKeylogger
658cb26b4f26e4ecf21c85c6138ceb52c614ca4092a69c365d324ff0b4b0d7c0
SnakeKeylogger
7370349d22f65927955d817fde07a3c9e1b5235fe3091278ad6899d8026422e3
SnakeKeylogger
7c0ccddd1e886d81fbcd8e4c62e6d61ce7e78258825a1f2ef1bc7edca4179cd5
SnakeKeylogger
ba7fa01438610d59a23d6daaa7dac208e3a99ff8dd10dfd6d9be2a59d4ff557e
SnakeKeylogger
f293c00ae925b1e3160d4104f35de999a31728aa5b636dd945d2ceb1d5045c01
SnakeKeylogger
f5b5997f3b718acf9ad712558e910e0d0c4777d8882207c05510f6c42cb3013d
SnakeKeylogger
+ 5'652 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/221006-k96smsggf9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cd82939a-eb01-446a-9f68-eaad94ac7651
Unpacked files
SH256 hash:
358de029e5afdbebc5e0e781581aab5948174779474c7a3c715854e718a50135
MD5 hash:
2229a4a3d0e9f1ad56d3f75bcfd19af9
SHA1 hash:
df81e3c191510ead911d2e42e1705d5f40b49f37
Link:
https://www.unpac.me/results/f08e2fff-a1d4-4580-ba84-09a1f47cbf06/
SH256 hash:
5fbdcb76c77563ed3d729fdca3396169c54443253001cf9b1b6b75a0f75cdcb4
MD5 hash:
629c31e71cfa6aab7a62bef45298816c
SHA1 hash:
932da9270d08d3b97ad1fb75e3d3180481f91096
Link:
https://www.unpac.me/results/f08e2fff-a1d4-4580-ba84-09a1f47cbf06/
SH256 hash:
e4576aaeaeaa22b85caf8e87cdd217841b6f8d4021b18bc7eae9935d14c4fe0b
MD5 hash:
9a11c49b9e235f4f6f898d13e649af92
SHA1 hash:
4bf7db635181aa2777ff461dbff957d052bd5cd2
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/f08e2fff-a1d4-4580-ba84-09a1f47cbf06/
Parent samples :
f5ab7866190abc14eddca1da11101e7f76ff08abce7c73350f15fd6f5ceda77a
cb2a2ca9c34ed19856b974b65ad163f37e49ab1cbe1471a5eec1db18a6b9c722
1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1
SH256 hash:
c7759124b270d312d9250c432f6d6f9be0e2c5682f4ba9729e27878ed71c2938
MD5 hash:
bd1513147a6f515bd2037bcb0e365b77
SHA1 hash:
11768516dbc7acbf42f6a9da19eba7477f373dfa
Link:
https://www.unpac.me/results/f08e2fff-a1d4-4580-ba84-09a1f47cbf06/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/f08e2fff-a1d4-4580-ba84-09a1f47cbf06/
SH256 hash:
1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1
MD5 hash:
fc6a61ebe3359d87aee1b2759fd51fbd
SHA1 hash:
3af94de8f4160c3278fec523c63edaf3ddb70960
Link:
https://www.unpac.me/results/f08e2fff-a1d4-4580-ba84-09a1f47cbf06/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1a527a566735/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

tar f27ebcfe76982f9574ed7f4403b3ce72f8ba7c3284fde7644e8d4ce9d076391a

SnakeKeylogger

Executable exe 1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/317195/
  
Dropped by
SHA256 f27ebcfe76982f9574ed7f4403b3ce72f8ba7c3284fde7644e8d4ce9d076391a
  
Dropped by
MD5 a83b88ced24fc211084c5c70526725bd

Comments