MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b
SHA3-384 hash: e6c526d7eaa8b2ee48a57a73611e908aed24b3134d3585479ffeb73cb8ad1c5b8244b4e280368d709b58feabbf04a5d6
SHA1 hash: e57eac081867e60501a1b9f814c9c7504eebe9d2
MD5 hash: 6a21ed805db791eda807badcab8d562a
humanhash: music-four-mobile-nuts
File name:6a21ed805db791eda807badcab8d562a.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:934'400 bytes
First seen:2023-05-05 11:23:59 UTC
Last seen:2023-05-13 22:44:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:fpBq5GkjmZ1ni4IyIHp+bWM3mr5S+MF8NcU/zQ4baiG1qKQaf8i8vONLyZyS7cH8:fpkGkjG9qemU+w8cU/zQ2aR+aEi4C
Threatray 5'407 similar samples on MalwareBazaar
TLSH T1981528AC312071DEC86BCD328AA87C64EA6034BB93CFD603912715DD9A4DA97DF141E7
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
220
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6a21ed805db791eda807badcab8d562a.exe
Verdict:
Malicious activity
Analysis date:
2023-05-05 11:42:54 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/c6a85b26-8bf3-4f47-93b8-bdb1dcb837ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/386804/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66834084.14213.31492.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/6454e757eb65188ee4ceb19c/reports/8b1521a3-cadd-4ccf-a62b-2241ce64c9c1/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1aed34a-dd68-414d-86cb-c2a73c583520
Result
Threat name:
Snake Keylogger, StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1226832
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2023-05-03 14:48:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
23
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e6q5x65ksc6lnj25hss3mm54cynjzr4awp4ojyj6fmsvp2caiqvq._file
Verdict:
malicious
Similar samples:
05d5959859302af9ef3ca1d463ea227f4e5d74a7bb100c7425db3d9e61e0b257
SnakeKeylogger
3f22bd2e20b994c404cdc3fd87820817b32c3471d003c3156186ecac22936022
SnakeKeylogger
55182f40b8372c9d9b9f8d5d59ce387b19acb5e355af6a40a6bfbb0bf64bd31f
SnakeKeylogger
978d65c4620865b35c4ff0aea3c6c0bf6774494b84113210d314c9edf48a6a54
SnakeKeylogger
b397cca1a04a9edb50e12c5f730cb660dff805000e6576455218dfd73a85e7f2
SnakeKeylogger
bc6f73a3805a709752228323fa42bf2806fe584f479496f6647db7ca05136299
SnakeKeylogger
c6e1df8bf12734eb6c733eb4902fa73a1d1b431dca5ab7b4501ec030c4e9f1e0
SnakeKeylogger
e6c7bf9f389f560ec25ba1808468c5d334cf75d2142face3704aac05af8c024b
SnakeKeylogger
fa7d933860e3500a28e659fcdf620b877bc3ddf20b8b99ccadfd261219492d4a
SnakeKeylogger
+ 5'397 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger family:stormkitty collection keylogger spyware stealer
Link:
https://tria.ge/reports/230505-nhqh5abf9w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
StormKitty
StormKitty payload
Unpacked files
SH256 hash:
280001013946838a651abbdee890fa4a4d49c382b7b5e78b7805caef036304e2
MD5 hash:
d4b6893a5512534104c6c7403be60897
SHA1 hash:
d4b51c3e4cafb3b146435a4e2e21bb5ddf15956d
Link:
https://www.unpac.me/results/7ba96165-58a3-4995-8790-62f8a0f7b154/
SH256 hash:
49b861dd612560ff8266043349e359c2bc008ff8c386b6585f874d7b1d67c42f
MD5 hash:
746491f91c7a65bb07ce288e48233ce9
SHA1 hash:
cc7d9930de112e4e4d4b382879eb96ce65e562ad
Link:
https://www.unpac.me/results/7ba96165-58a3-4995-8790-62f8a0f7b154/
SH256 hash:
e5518e76f14e87bcc58a705c6f8f3a686cbffefc0e55985d17a067adfddf3688
MD5 hash:
920a2854e9c183ad2ef7d5543c296d38
SHA1 hash:
2c20da753bdf6f1a46261e2c132dd42f75c94229
Link:
https://www.unpac.me/results/7ba96165-58a3-4995-8790-62f8a0f7b154/
SH256 hash:
9b1f7184cba2afc20eadaee1a3c1d55c18074b86d702583aae583ef501d10657
MD5 hash:
788131af69b7c03d4f98f5e6e517dc9d
SHA1 hash:
2b6081795b166a7babc6f7a7abcd78b4d211685d
Link:
https://www.unpac.me/results/7ba96165-58a3-4995-8790-62f8a0f7b154/
SH256 hash:
f21559d2021c0f98554936bc2243f7f35c227254d1db2768dcda64079419b9c5
MD5 hash:
e585b455385d90f34b9ff482ec81a836
SHA1 hash:
071bb65ef9f147bbb9119b5ab724859f6ecdbb8b
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/7ba96165-58a3-4995-8790-62f8a0f7b154/
Parent samples :
27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b
1046ce2655057bf77f032867b6966e9305a849885cbf2bfcc950aafefab9a732
508bc15e631f38832f95774c655bf4c0584801d21b09922e5d90807fb6849a3a
SH256 hash:
27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b
MD5 hash:
6a21ed805db791eda807badcab8d562a
SHA1 hash:
e57eac081867e60501a1b9f814c9c7504eebe9d2
Link:
https://www.unpac.me/results/7ba96165-58a3-4995-8790-62f8a0f7b154/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/27a1dbfbaa90/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 27a1dbfbaa90bcb6a75d3ca5b633bc161a9cc780b3f8e4e13e2b2557e840442b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2346135/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/386804/

Comments