MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4
SHA3-384 hash: 231b7cbe066fd0fce69c6705ee94e3d4c206e572e46d8c4c54fc5013ed19886acaf47ca4e2e4fb05f078030e09f4462b
SHA1 hash: f25f8e0786f25e4ed04b4a9bc2730cad02a4e4b9
MD5 hash: 7a20fca2f86df8d559c5375f340463a5
humanhash: diet-august-snake-golf
File name:bank swift... Scan pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:942'592 bytes
First seen:2021-07-19 09:25:54 UTC
Last seen:2021-07-19 12:09:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:reNyvUIZbVtBPIKlBPUegPy3U2Sn0bCfKjGDncJOhdEe9CyXCzI4QG:nvDBtBPIoBPEkUxnOkKjGDpQe9CyX2
Threatray 1'076 similar samples on MalwareBazaar
TLSH T17F15BF166203E204DC3847F6DC29C9F016AB7C26E939D16F2AC8BE7F79B32F915A1145
Reporter cocaman
Tags:exe SnakeKeylogger SWIFT

Intelligence

File Origin
# of uploads :
5
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bank swift... Scan pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-07-19 09:27:32 UTC
Tags:
evasion trojan snakekeylogger keylogger
Link:
https://app.any.run/tasks/9b5772d4-5774-4f06-9bc2-3de596c24f37

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172511/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.931.23052.22590.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/588c1b16-2496-4747-9867-9445fc7d26f4
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/818161
Signature
.NET source code references suspicious native API functions
Found malware configuration
Injects a PE file into a foreign processes
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-19 01:26:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fki6hrlnfzxigs673kzhwieshbwvjhk67bktnkvhntsyfhiqsdsa._file
Verdict:
malicious
Similar samples:
047d3bebe340180add07832e734233f7aa762de34f1eca2b5059d48a2daca6bc
SnakeKeylogger
3462dbe2da5d88864ce06d221eb425c23b6a3c70f976e9fcde8f838dc5915f64
SnakeKeylogger
4646cdc649c3d1a2c68fdf4f40f1006b55ed3d30bbe0e07b2e27ac91edcdba21
SnakeKeylogger
6dda8584a5682afdc017e2e421619b02fc9f57a67de615332797b3e96981864d
SnakeKeylogger
71fb2874f7a7da6d0f0e528f0b0d2d98c74afe88d894ee6f29387ba3bb540c37
SnakeKeylogger
85dd5d9ef955400038cae7ac32f2931c3b6966792bbfd353f14627c2261f2d9c
SnakeKeylogger
a730154eedce8c175f18e82c1102e01a7ee94fd74cbee7df85b473233ea764e6
SnakeKeylogger
bfa0c6d6a166011476ffd4f4fa1c2c1669c273fa945f729267fa537ce7689b44
SnakeKeylogger
e096e858f6e33e79359f9be68c43cdb8536c99a6282adb420496e11b12a4aa4c
SnakeKeylogger
ef93be06b93e89bc68dd92ca713f40e320a654c49a241a6884785acf964b8ba9
SnakeKeylogger
+ 1'066 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210719-eceprnncnx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
83d9e44d9a311ea6fdbcbd09fdc816a2067806dcacf24beb5ee786191b1a3ea1
MD5 hash:
b1a7b752b6638ee03cffe5a1dde9213e
SHA1 hash:
52d215a173d2f293990f8c12fc7f4a86330a29cb
Link:
https://www.unpac.me/results/2a0bec99-ee1d-47cb-8a22-060f59f547c7/
SH256 hash:
2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4
MD5 hash:
7a20fca2f86df8d559c5375f340463a5
SHA1 hash:
f25f8e0786f25e4ed04b4a9bc2730cad02a4e4b9
Link:
https://www.unpac.me/results/2a0bec99-ee1d-47cb-8a22-060f59f547c7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626

SnakeKeylogger

Executable exe 2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626
Cape
Cape
https://www.capesandbox.com/analysis/172511/

Comments