MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6
SHA3-384 hash: c3fdaf91c352a70070cbff7e17086aab1279504a42f13acec6ffc674af2a421a5fab5b74780473c6310281a6370da9d0
SHA1 hash: 60fa616c1ff8ecbe854e880ee35276b0d16deca5
MD5 hash: 8fbba42e36615309fc2f61e5b710bc4e
humanhash: summer-alanine-delta-video
File name:Hesabınıza para geldi...pdf...exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:788'445 bytes
First seen:2022-09-30 10:38:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (390 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 12288:fToPWBv/cpGrU3yVJW0qGf0SQ/+Fhu9/KR57eRGQOeVo+W1:fTbBv5rUcqGf0x/+QiR4G7b1
Threatray 1'563 similar samples on MalwareBazaar
TLSH T10AF4E182F59044F1E8771A3265271E11583A3C785FB5CA9F73E4322AAFF21D28136B67
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 068f0b2a2b363f06 (19 x SnakeKeylogger, 8 x AgentTesla, 8 x MassLogger)
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315137/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process by context flags manipulation
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40181/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6336c74d49c58ce767c439dc/reports/6a5ad795-5009-4ca7-a320-3b5d5586af26/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3854df9a-58a7-4fef-b51b-9b5777efe2ec
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1080803
Signature
Antivirus detection for dropped file
Found hidden mapped module (file has been removed from disk)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
PE file has a writeable .text section
Yara detected Generic Downloader
Yara detected Generic Dropper
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6/
Threat name:
Win32.Worm.Picsys
Create hunting rule
Status:
Malicious
First seen:
2022-09-30 10:39:41 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e336ategnoj5kt4uz24nvzbxu2rpuoocofluz644nisxr6rgh6ta._file
Verdict:
malicious
Similar samples:
1a37f5980dfaccf82f357074e3d3013e6280e14ddb291ff49b539393daa9da6d
SnakeKeylogger
290b9cd7f795ed30712637f8e6f7779412260c6f7ac70c70615d2e4a92960e0a
SnakeKeylogger
301a3e665000c99ab655a74dbf9408de24875866528be4f6d28e83490c19305b
SnakeKeylogger
339539d03ce22693c391b3141e6c20b2403da4efe6e25247c87c81a2e2fe1530
SnakeKeylogger
390ba9da469491e34db509524293b00feb22b768a11c0792d67c92b17881a521
SnakeKeylogger
432c99b8f1108ed0d94b7b1e620b230f8f55c47ca62c0fcdd1a3afac8548f239
SnakeKeylogger
7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e
SnakeKeylogger
c787c9a5f407a656478efc835f1a0f8f738030bf26cedbd4748cb7b18ed2ea3e
SnakeKeylogger
f56bd344f2e9650ba6def3340bc5ac26472ea615744b38786d5445a75a0e51b4
SnakeKeylogger
+ 1'553 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220930-mpymmsecan/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c4a5d644-6879-4157-8535-79607e93b85b
Unpacked files
SH256 hash:
6ffc9b4e7897bf9b477355154d800091c8e225ab5928fd0935f31b83e367b530
MD5 hash:
d69438dcad59bfa694a0faf1d11cd0c9
SHA1 hash:
c1d3bf05ad948f9a2667b6fa08e0cae0e4220c9b
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/df5e4e68-f52d-42f9-8fa4-982388907ff4/
Parent samples :
339539d03ce22693c391b3141e6c20b2403da4efe6e25247c87c81a2e2fe1530
fd34c505f68158cc8090e0e0ea5d3ece3df792c6ec3a7648ec484a5cafee5600
26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6
d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1
SH256 hash:
f5421ad34a0328fc14146058f4059b64deea2fda38c77416f1770c3794061f27
MD5 hash:
0e5a933f8e64bbf268d05cd9110ef6a1
SHA1 hash:
a979f34e2c916fe19d9b909d43005358e6ef6686
Detections:
win_mofksys_auto
Create hunting rule
Link:
https://www.unpac.me/results/df5e4e68-f52d-42f9-8fa4-982388907ff4/
Parent samples :
26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6
d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1
dcf5a9ee29889bc50645eb2cc01e1d0449550d9757e200ae8cd86b175d87ab1e
162e62a5fdd086d5d83c8d7cf95361fa0592c457b421e170bc00b525b7691bfc
4815c4b0a11e7bd4bac2db7bff612905804f5ec2272a6c299f842f572572f135
SH256 hash:
e2e8599f91c360b15191adb5252072359202780ab958df67677723121fdabfd2
MD5 hash:
9eb6255939de69066bbf83c7297bc71c
SHA1 hash:
6baa7833d9e80dda66896e396df210f2a25afd99
Link:
https://www.unpac.me/results/df5e4e68-f52d-42f9-8fa4-982388907ff4/
SH256 hash:
26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6
MD5 hash:
8fbba42e36615309fc2f61e5b710bc4e
SHA1 hash:
60fa616c1ff8ecbe854e880ee35276b0d16deca5
Link:
https://www.unpac.me/results/df5e4e68-f52d-42f9-8fa4-982388907ff4/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/26f7e04c866b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RansomwareTest8
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/315137/

Comments