MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25f255928492775b77841008191950270dede41fc97a1011e3a8be395d5a3a7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25f255928492775b77841008191950270dede41fc97a1011e3a8be395d5a3a7b
SHA3-384 hash: fc924631a59e58fa208e436f836d0d88c7bd6ce13692008a9c8d2c46c5c235b851eb7b223f02decef361f72677f1e392
SHA1 hash: bc6af1efd2082310800ecb7bb0f6d1c62b348202
MD5 hash: 5b87572e958972acd5a11b414fc6fadc
humanhash: colorado-nineteen-oven-mike
File name:Quote.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:514'048 bytes
First seen:2021-07-19 05:54:57 UTC
Last seen:2021-07-27 17:54:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:QNZc3tFNiKnUH7PrjSzKkTFSvhjd/EzhnZSRVoVrNxTmXyvhKL9gK9R8HE:t4UIo9ZW
Threatray 296 similar samples on MalwareBazaar
TLSH T15DB4383439FA502AB173EEAA8BE475EADA6FB7733B07645D105003464723D41EEC253A
Reporter cocaman
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
4
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quote.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-19 05:56:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/687f5c82-30bf-4e23-9966-cba6263dafd9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172469/
Detection(s):
SecuriteInfo.com.Artemis5B87572E9589.18105.8071.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/364e084c-9299-43f3-91f6-ddf14ec63cbe
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/818050
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25f255928492775b77841008191950270dede41fc97a1011e3a8be395d5a3a7b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-19 02:19:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=exzfleuesj3vw54ecaebsgkqe4g63za7zf5baepdvc7dsxk2hj5q._file
Verdict:
malicious
Similar samples:
3de2043d5dc6aa1879f040d9c69e905424acabe29ac4162752bbf57f83ae58a6
SnakeKeylogger
48b0e86fec639744a4907f199f83fda003f53d6d705a6f767e6796ab9e67bdd4
SnakeKeylogger
578aa3607cb34fde024d099b916e61c0a767d952312a2e8c9276f3167a65ad14
SnakeKeylogger
69950e3903237ab9d6441a23af192268cf49da8e1034f77990833a60738090a6
SnakeKeylogger
b5e1daebfb2aa234328dc9776a1ecc77dd2726a7709c353c0265d8b1f4803f1c
SnakeKeylogger
b9acd58a25a9493713c0b5a3be62db4338de550aad1b23054d4be3de0c1b0c46
SnakeKeylogger
c39703a0644e67f2c3486446350a71c559d3f35414df73dbcde3fb731948eb2f
SnakeKeylogger
c4e1ba047b2fa0d07de6a124e882025489d5ff95e2a2cef31c4526199636f3cd
SnakeKeylogger
dc5458e66a8c76f55a5f490f5c9d12ea6e92a67c6ed74dbe40ca066a149d1659
SnakeKeylogger
e0c5194ec5dd17f0a5f77c156e99deafdee0c6e25b5c54c4bedc7bc5420f3a1d
SnakeKeylogger
+ 286 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210719-2vp85ppw5x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/2052dba5-e5d7-4d19-9154-2019e2914927/
SH256 hash:
5f0eab3f72327251d55360e236f800c5f52a6a0aeb52cb370a962785df9d32ba
MD5 hash:
d0102750e5bc7e80df2938d25b1841ee
SHA1 hash:
c3ee5e1059ee15176b6a3852a9613f1718e76f6e
Link:
https://www.unpac.me/results/2052dba5-e5d7-4d19-9154-2019e2914927/
SH256 hash:
849bbd726e3cd002744f7c2c03eb93d4b52d9e7e64a2bc6a820ab56d1ce44b27
MD5 hash:
a646a35f0ab14b80dc54ed5109047ca5
SHA1 hash:
af03ea356654255e0bcc196dd173f182d4367316
Link:
https://www.unpac.me/results/2052dba5-e5d7-4d19-9154-2019e2914927/
SH256 hash:
25f255928492775b77841008191950270dede41fc97a1011e3a8be395d5a3a7b
MD5 hash:
5b87572e958972acd5a11b414fc6fadc
SHA1 hash:
bc6af1efd2082310800ecb7bb0f6d1c62b348202
Link:
https://www.unpac.me/results/2052dba5-e5d7-4d19-9154-2019e2914927/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/25f255928492775b77841008191950270dede41fc97a1011e3a8be395d5a3a7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip cd87994022445bf2097ea2ff491c084d5c323c54cdc8c6c5c97b026567227d77

SnakeKeylogger

Executable exe 25f255928492775b77841008191950270dede41fc97a1011e3a8be395d5a3a7b

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 cd87994022445bf2097ea2ff491c084d5c323c54cdc8c6c5c97b026567227d77
Cape
Cape
https://www.capesandbox.com/analysis/172469/

Comments