MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 269135909706b22a5060b5d53ecea40ffa8d1fe1d1f13fe80062bcb37db09918. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 269135909706b22a5060b5d53ecea40ffa8d1fe1d1f13fe80062bcb37db09918
SHA3-384 hash: 2d8629d41e4ed5d5d8a8cc03aa2368d38c1e1cde3754aca1253a450ed92fc92bb37dc57f462530dc9d1d63c9b51e8cce
SHA1 hash: 1ab24b799dfd09608aa222ce5972e61a631c6135
MD5 hash: 0f2c6b78d8990982708912f64327220c
humanhash: bulldog-asparagus-low-carolina
File name:269135909706b22a5060b5d53ecea40ffa8d1fe1d1f13fe80062bcb37db09918
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:493'056 bytes
First seen:2022-11-08 14:49:40 UTC
Last seen:2022-11-08 16:45:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Ph790jc12eI6lsiWW8sNas5R9Cz5thlXgWfmEyL:4cfI6fWIN/9CNflXgYmEyL
Threatray 7'407 similar samples on MalwareBazaar
TLSH T1D0A4233A9616A3B3CA8B13F8FD5F0B471B734945E2F194FF6A4DAA5801B390951054F3
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f4f4ac8cacacd4d4 (85 x Heodo, 11 x Formbook, 10 x SnakeKeylogger)
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
162
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
269135909706b22a5060b5d53ecea40ffa8d1fe1d1f13fe80062bcb37db09918
Verdict:
Malicious activity
Analysis date:
2022-11-08 14:52:08 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/5ad99e70-0437-48ad-b687-0af6dcb7b51c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/330601/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.738.13154.32751.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Creating a window
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/636a6c9a4d3db48878e09efb/reports/e2d3428b-d120-4cd9-95bd-6785ca2c40a9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d1a1e49-878e-4a74-a32e-cb8a8f5f17dc
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1108667
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 741329 Sample: NmXANnIUsc.exe Startdate: 08/11/2022 Architecture: WINDOWS Score: 100 55 Snort IDS alert for network traffic 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 Sigma detected: Scheduled temp file as task from temp location 2->59 61 9 other signatures 2->61 7 NmXANnIUsc.exe 7 2->7         started        11 tsfnznFbNCQB.exe 5 2->11         started        process3 file4 37 C:\Users\user\AppData\...\tsfnznFbNCQB.exe, PE32 7->37 dropped 39 C:\Users\...\tsfnznFbNCQB.exe:Zone.Identifier, ASCII 7->39 dropped 41 C:\Users\user\AppData\Local\...\tmp6363.tmp, XML 7->41 dropped 43 C:\Users\user\AppData\...43mXANnIUsc.exe.log, CSV 7->43 dropped 63 May check the online IP address of the machine 7->63 65 Uses schtasks.exe or at.exe to add and modify task schedules 7->65 67 Adds a directory exclusion to Windows Defender 7->67 13 NmXANnIUsc.exe 15 2 7->13         started        17 svchost.exe 3 7->17         started        19 powershell.exe 19 7->19         started        21 schtasks.exe 1 7->21         started        69 Multi AV Scanner detection for dropped file 11->69 71 Machine Learning detection for dropped file 11->71 73 Injects a PE file into a foreign processes 11->73 23 tsfnznFbNCQB.exe 14 2 11->23         started        25 schtasks.exe 1 11->25         started        27 tsfnznFbNCQB.exe 11->27         started        29 tsfnznFbNCQB.exe 11->29         started        signatures5 process6 dnsIp7 45 checkip.dyndns.com 132.226.247.73, 49704, 80 UTMEMUS United States 13->45 47 checkip.dyndns.org 13->47 75 Query firmware table information (likely to detect VMs) 17->75 31 conhost.exe 19->31         started        33 conhost.exe 21->33         started        49 193.122.6.168, 49705, 80 ORACLE-BMC-31898US United States 23->49 51 checkip.dyndns.org 23->51 53 192.168.2.1 unknown unknown 23->53 77 Tries to steal Mail credentials (via file / registry access) 23->77 79 Tries to harvest and steal ftp login credentials 23->79 81 Tries to harvest and steal browser information (history, passwords, etc) 23->81 35 conhost.exe 25->35         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/269135909706b22a5060b5d53ecea40ffa8d1fe1d1f13fe80062bcb37db09918/
Threat name:
ByteCode-MSIL.Trojan.REMLoader
Create hunting rule
Status:
Malicious
First seen:
2022-10-28 02:59:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e2itleexa2zcuudawxkt5tveb75i2h7b2hyt72aamk6lg7nqtema._file
Verdict:
malicious
Similar samples:
26d40d55e47d0d62e5caa555615d6ec45bd5eefbc2e2f7d0be6736433ba5d0fb
SnakeKeylogger
376c999716183d5e6971b9ed0ac92442bb670b3e362b1dad2ff366a34e052002
SnakeKeylogger
3adfda6dc7720c78135fcccb714e09432afde40e5d05669d6c27a4f850ec33fc
SnakeKeylogger
4ade79259ddc557d6b0abf68de4b5fbe61e532db6eae5b29ef30e3a71bbf17e2
SnakeKeylogger
512f81dbb72e5d2b8c8901aabc5ab8f1f8ffa6d194a2c407fc38e23967047915
SnakeKeylogger
6ee9bad01cd8605ac15e9053069ab4b8435af8d971cde22aac2a9434a81654d8
SnakeKeylogger
7d7136bae1b64f934f011d598209bbfb53821d3f6245fdc62bc4a624e221c8e1
SnakeKeylogger
+ 7'397 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221108-r7k7gsedak/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5689050416:AAER7vL3U497aoq7pzBRC3Ror1bDYoH5KAQ/sendMessage?chat_id=1736922894
Unpacked files
SH256 hash:
5d6b1261e0b386aa76ee1d920a2b37962e62257242d8dbc9732c23e29342aa47
MD5 hash:
f188cd4bd817a4ccb603b89bda726505
SHA1 hash:
eb3443533599cec377693cf14325cc014852cab8
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/060fccb1-9129-4bc7-8e05-6eb204a76f23/
Parent samples :
ba35baf8db8fa9fb43be006c021133da45e06fa092eee3981feac3244aeaa0e5
e29862ea0a5f15f4612184f0c4afe079dd03f17d072049ba49a71ec0afe3a197
392eeab0970120d5610a1707ecd9062d38f4ccb6946eec9d0c057fbc82e246fa
269135909706b22a5060b5d53ecea40ffa8d1fe1d1f13fe80062bcb37db09918
add086e8bdf4d98a4d737d3da0bc6282461c2fff9f9eb4a37007242c90e42aad
5d6b1261e0b386aa76ee1d920a2b37962e62257242d8dbc9732c23e29342aa47
SH256 hash:
80f87fb1b3594f413233707be90200cc40e005c82021945b6ad6e19b12c31587
MD5 hash:
93afedc52f887ef2ee3eba2ec990c93e
SHA1 hash:
b12c269dd82920590de9a6eb7e4b66aa0f35a562
Link:
https://www.unpac.me/results/060fccb1-9129-4bc7-8e05-6eb204a76f23/
SH256 hash:
248a7c4997aacb14ca032daf9668636839f921d0a3403f09a3b0ccfdc948cbf1
MD5 hash:
a7952169b04a2c6a39661aad59e79dcf
SHA1 hash:
88722f1a32c913307c0c6385b04478a79fabd12b
Link:
https://www.unpac.me/results/060fccb1-9129-4bc7-8e05-6eb204a76f23/
SH256 hash:
744928a56b4d36f17e73eea0534c5e99103d1553d5b0a864a6fd9d4f9899b47f
MD5 hash:
91fed5db1afcdf48e0cd6d4058a013ba
SHA1 hash:
3717b3346e25d3f66f00626ad1a771d8655f485f
Link:
https://www.unpac.me/results/060fccb1-9129-4bc7-8e05-6eb204a76f23/
SH256 hash:
f64c06affbdad60cb20ea1f4fb37979cf9bf28d7bfd1f1545f7aadf73926f207
MD5 hash:
7a1d3e8ff12cb16329e860a50c7a4169
SHA1 hash:
118d6f2aebd66d292e2dabbdd1afacf11e7cab38
Link:
https://www.unpac.me/results/060fccb1-9129-4bc7-8e05-6eb204a76f23/
SH256 hash:
269135909706b22a5060b5d53ecea40ffa8d1fe1d1f13fe80062bcb37db09918
MD5 hash:
0f2c6b78d8990982708912f64327220c
SHA1 hash:
1ab24b799dfd09608aa222ce5972e61a631c6135
Link:
https://www.unpac.me/results/060fccb1-9129-4bc7-8e05-6eb204a76f23/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/330601/

Comments