MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fec8f73f9d81a56157b4457c26fbbcd175fda95a2b9c77aaa2fab99c1a776dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fec8f73f9d81a56157b4457c26fbbcd175fda95a2b9c77aaa2fab99c1a776dd
SHA3-384 hash: f5139045e5cfcdade30bb29fa7eb94911ad1238d62f18d0750a3be9005dc342414cf5892ce5bad22b186a4e16f9c5737
SHA1 hash: f16f4fb435fbf34602a0f26a7e0ec768e4031142
MD5 hash: fed83d37cbd4ab15e8587c17257bfd59
humanhash: illinois-oranges-october-lion
File name:iXQKqQRUEetloRB.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:868'352 bytes
First seen:2021-07-06 15:59:23 UTC
Last seen:2021-07-06 17:18:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:d8dJR0m0R86NsBtD/F08SxyeGG/+x270EdlM1lPH23fExeZa:d8d/0326NUYZoU6H23M4Za
Threatray 13 similar samples on MalwareBazaar
TLSH E1058E7651768F92EDBFCB785375261C4FE9B377D34BF6B82C9460990480F804A62A23
Reporter cocaman
Tags:exe INVOICE SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
iXQKqQRUEetloRB.exe
Verdict:
Malicious activity
Analysis date:
2021-07-06 17:05:35 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/6e31d195-75c3-490a-b5e5-b379294b834a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170018/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.14046.18888.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/64224809-aa9d-428c-978c-cf9d0b09be66
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/812467
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fec8f73f9d81a56157b4457c26fbbcd175fda95a2b9c77aaa2fab99c1a776dd/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-06 16:00:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7wi647z3anfmfl3irl4e353zulv7wuvuk44o6vkf6vztqnho3oq._file
Verdict:
unknown
Similar samples:
1b22054e5e50c8a9323d4bd781fbeaff2611f65299b321fe2a1dc855d70c8904
SnakeKeylogger
266b2cec76af399c55968fbd2a859d9d16de69f66eb8daf6cc782f9c82ae2aee
SnakeKeylogger
3e78765ba856759e65007d23fd518d450599157e5a4ce5fe014051a19715eb97
SnakeKeylogger
595dbce05040931410ecbf367e111d112b83cbbd6373ebe934e869140fd0ceb0
SnakeKeylogger
93fa16fb44a1c4bc7fe5ff20de97329824929e679d50aa2fc19c9688bfe95708
SnakeKeylogger
aaacdc757d39cd544288dcc7d9fc635dfc4942ed360b63c7be0d79525697fe30
SnakeKeylogger
b59c23b6613490950e23d61799144b6298fc6ce96545bae5448c6a08c0521483
SnakeKeylogger
ea35c04468d68c2fde827d915e0ffac88a6e01249e3196148d1681c8ad91e9a9
SnakeKeylogger
f365c491faaba01943e7ab894d34fccacbb9d2e8b9bcbe9f6eaf0e47aa420329
SnakeKeylogger
faddb41690e2a06a400248d03aebc186f54cc62f522e54c21e482d7bd165c720
SnakeKeylogger
+ 3 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210706-lxrt1p1s4a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
5209992fd1f96cd1959efb5e1afa71f5c9ae2ab4430e258fe9d0ec915098d110
MD5 hash:
257ca10e5cbb2f8bdf0ae6f3e900e11e
SHA1 hash:
9d25ee80dbe3bbce5ab4479912c5e21b19b6aeec
Link:
https://www.unpac.me/results/7f6353a3-36b4-4219-a4b8-d6810e07017b/
SH256 hash:
f29b80189976f49dc13394f14086b16846132423333da21ab144168cd8b44d53
MD5 hash:
bf97c486a33b47fc1c0f8e768bb7371d
SHA1 hash:
7da5301b238a34882d52e2cef3d209a2b5f0c45e
Link:
https://www.unpac.me/results/7f6353a3-36b4-4219-a4b8-d6810e07017b/
SH256 hash:
0c9f7a87d9182684eee3d8dafa5cd9456e221205ac3c25c653eaab6e6325a942
MD5 hash:
4f4749884352c1db1b020e45e87e40f9
SHA1 hash:
7857a3f6af06ac8fdf81816cfce49149389731ef
Link:
https://www.unpac.me/results/7f6353a3-36b4-4219-a4b8-d6810e07017b/
SH256 hash:
1fec8f73f9d81a56157b4457c26fbbcd175fda95a2b9c77aaa2fab99c1a776dd
MD5 hash:
fed83d37cbd4ab15e8587c17257bfd59
SHA1 hash:
f16f4fb435fbf34602a0f26a7e0ec768e4031142
Link:
https://www.unpac.me/results/7f6353a3-36b4-4219-a4b8-d6810e07017b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/1fec8f73f9d81a56157b4457c26fbbcd175fda95a2b9c77aaa2fab99c1a776dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip e4c8e9763193a01d78b51aa2534b8303c8956100cb261a6963f04a87fc6ca8fb

SnakeKeylogger

Executable exe 1fec8f73f9d81a56157b4457c26fbbcd175fda95a2b9c77aaa2fab99c1a776dd

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 e4c8e9763193a01d78b51aa2534b8303c8956100cb261a6963f04a87fc6ca8fb
Cape
Cape
https://www.capesandbox.com/analysis/170018/

Comments