MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22b094d56c15792d63cc0cd2782a51d0fdf9aac9f34059dc0771130b9d7b6ad1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22b094d56c15792d63cc0cd2782a51d0fdf9aac9f34059dc0771130b9d7b6ad1
SHA3-384 hash: 3c295632ab725ff976164f819963eeedaf168d681f1612db5705b4e74dbf3fb50f2b8ddd1b9e87b0b87e922afa662884
SHA1 hash: e92184788608b441b74fe0a47b5ed705e4805364
MD5 hash: 83bbde4e7d1bef6cb52749b9bbb574f2
humanhash: zebra-ohio-fruit-diet
File name:83bbde4e7d1bef6cb52749b9bbb574f2.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:519'168 bytes
First seen:2021-09-21 06:13:14 UTC
Last seen:2021-09-21 07:01:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:u6bccG+vfrspXuNrVoW+SM6u56OTznyouSmSX7:u9B+vTspXxW+SdEF6k
Threatray 1'511 similar samples on MalwareBazaar
TLSH T112B41865156E7D75C0B42B3A477317E51BEEEC402A3ACF896B21F279103C6D7BE4220A
File icon (PE):PE icon
dhash icon 70f09a5bbaaed451 (12 x SnakeKeylogger, 3 x AgentTesla, 1 x Formbook)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
83bbde4e7d1bef6cb52749b9bbb574f2.exe
Verdict:
Malicious activity
Analysis date:
2021-09-21 06:16:22 UTC
Tags:
evasion trojan snakekeylogger keylogger
Link:
https://app.any.run/tasks/b28f8be0-cf96-4f40-9955-d00a25f3c97b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189646/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1032.9124.6061.UNOFFICIAL
Create hunting rule

Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea56f8a8-d703-4b36-883d-f5abbd6b30eb
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/854572
Signature
.NET source code references suspicious native API functions
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 487009 Sample: aHhCejHT9d.exe Startdate: 21/09/2021 Architecture: WINDOWS Score: 100 67 Found malware configuration 2->67 69 Malicious sample detected (through community Yara rule) 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 4 other signatures 2->73 9 uyfdfgh.exe 3 2->9         started        12 aHhCejHT9d.exe 3 2->12         started        process3 signatures4 75 Multi AV Scanner detection for dropped file 9->75 77 Machine Learning detection for dropped file 9->77 14 vbc.exe 2 9->14         started        18 cmd.exe 1 9->18         started        20 cmd.exe 1 9->20         started        22 cmd.exe 1 9->22         started        24 vbc.exe 15 2 12->24         started        26 cmd.exe 3 12->26         started        29 cmd.exe 1 12->29         started        31 cmd.exe 1 12->31         started        process5 dnsIp6 57 checkip.dyndns.org 14->57 59 104.21.19.200, 443, 49746 CLOUDFLARENETUS United States 14->59 79 Tries to steal Mail credentials (via file access) 14->79 81 Tries to harvest and steal ftp login credentials 14->81 83 Tries to harvest and steal browser information (history, passwords, etc) 14->83 33 schtasks.exe 1 18->33         started        35 conhost.exe 18->35         started        37 conhost.exe 20->37         started        39 conhost.exe 22->39         started        61 checkip.dyndns.org 24->61 63 checkip.dyndns.com 193.122.130.0, 49739, 49745, 80 ORACLE-BMC-31898US United States 24->63 65 2 other IPs or domains 24->65 85 May check the online IP address of the machine 24->85 53 C:\Users\user\AppData\Roaming\uyfdfgh.exe, PE32 26->53 dropped 55 C:\Users\user\...\uyfdfgh.exe:Zone.Identifier, ASCII 26->55 dropped 41 conhost.exe 26->41         started        87 Uses schtasks.exe or at.exe to add and modify task schedules 29->87 43 conhost.exe 29->43         started        45 schtasks.exe 1 29->45         started        47 conhost.exe 31->47         started        file7 signatures8 process9 process10 49 MpCmdRun.exe 33->49         started        process11 51 conhost.exe 49->51         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22b094d56c15792d63cc0cd2782a51d0fdf9aac9f34059dc0771130b9d7b6ad1/
Threat name:
ByteCode-MSIL.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2021-09-16 06:53:05 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
104ff8c9a13125d6652d1dd1d9158b1612cd92bf6bf1bd4e4b73f112ece7a159
SnakeKeylogger
12b953981ab51aab44eadc729fbb03d0d6685a526b370de9d3a0ce390e14343f
SnakeKeylogger
5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a
SnakeKeylogger
599ed346c41bd6c8de85ce906bdf6b840f55383fa2fe25d272b30215c4331230
SnakeKeylogger
a937ea15f15c9ea7ac496b540ff4243276746550d72b908d2151c2b4f9fc76bf
SnakeKeylogger
af41223eb9daa98fea5555e90a232634848bcc1801315a6f47edf20bbe086d3f
SnakeKeylogger
c15017d56ac6e02cf607d7188d5b4bb5485d9463031ba4effcb29ca84eb83dea
SnakeKeylogger
c42fd1850e75b18ebacdb8e14d9c612d4c5cf554d0206ce0a7a4735f5fedd591
SnakeKeylogger
d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c
SnakeKeylogger
e6c329ca3efff2d64a73de0483e5059fbf57d57cdb03f4d156f64a932450b140
SnakeKeylogger
+ 1'501 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210921-gzcj9sbbgr/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Uses the VBS compiler for execution
Executes dropped EXE
Snake Keylogger
Unpacked files
SH256 hash:
5cdddc20a4b8585ccb5dc83e9676a9d2350cbdaac7dc36d17dccf4212878e3ac
MD5 hash:
5627540b8d89ef1e3897054189a8e6c4
SHA1 hash:
3aed5c24830097be8964419d8d4457b11ae07001
Link:
https://www.unpac.me/results/63988485-c22d-414a-8c07-2e9d35d7384a/
SH256 hash:
22b094d56c15792d63cc0cd2782a51d0fdf9aac9f34059dc0771130b9d7b6ad1
MD5 hash:
83bbde4e7d1bef6cb52749b9bbb574f2
SHA1 hash:
e92184788608b441b74fe0a47b5ed705e4805364
Link:
https://www.unpac.me/results/63988485-c22d-414a-8c07-2e9d35d7384a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22b094d56c15792d63cc0cd2782a51d0fdf9aac9f34059dc0771130b9d7b6ad1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/189646/

Comments