MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b93d5cd493cadccd9df739492092cca9cee77a5ccc7b70418002e1139be9703. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b93d5cd493cadccd9df739492092cca9cee77a5ccc7b70418002e1139be9703
SHA3-384 hash: f9d583d73adc44c5e6e302e35d53149b665d13cdf1c9a18469c4ee1ed7273aecf722de05771f1b8f52d25c1a9b199bde
SHA1 hash: a90d824f270c360550b0f1b7665850db8e6bc755
MD5 hash: 2016b846529059705f93599879abf6db
humanhash: purple-nineteen-blue-don
File name:PO2762712 and Company Profile.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:6'247 bytes
First seen:2022-06-06 13:22:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 96:GZmPHolrUZAu7Fb8+wDJ7AHEmhNaLgW44CnWZHgXUteBQkcHdBMcDidRZwYYMNB:/yrU+UteDJ0kmDaCcHgLx8VDyRZwjm
TLSH T152D17CB0F3726CAA6A93D636C69350BDDC4D021E6F7F18B24176962AC4DECC8065260E
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:SnakeKeylogger zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""OILTEK SDN. BHD (64991-P)" <support@swansfiber.com>" (likely spoofed)
Received: "from ns1.udtabazar.com (unknown [74.208.244.69]) "
Date: "Mon, 6 Jun 2022 10:07:59 +0000"
Subject: "Company Profile and PO #000001"
Attachment: "PO2762712 and Company Profile.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
328
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs163.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/629dff945dc88d357164e9bb/reports/c60edb76-239e-4a4c-a1f6-e9cd14716122/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2b93d5cd493cadccd9df739492092cca9cee77a5ccc7b70418002e1139be9703
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b93d5cd493cadccd9df739492092cca9cee77a5ccc7b70418002e1139be9703/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-06-06 13:22:08 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
9 of 40 (22.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=foj5ltkjhsw4zwo7ookjecjmzkoo455fztd3obayaaxbcon6s4bq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/220606-ql79fsgde7/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5418692741:AAHXSH9AIdrreyWWR5BBMgx8OYYc3jLfXN0/sendMessage?chat_id=5571556378
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/2b93d5cd493cadccd9df739492092cca9cee77a5ccc7b70418002e1139be9703

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 2b93d5cd493cadccd9df739492092cca9cee77a5ccc7b70418002e1139be9703

(this sample)

SnakeKeylogger

Executable exe 075d1ac0887f0028c537e2b45c1d1686d26e18464792ca65b374a4ac82261d93

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 075d1ac0887f0028c537e2b45c1d1686d26e18464792ca65b374a4ac82261d93
  
Dropping
MD5 cc71d6fd52a858f71e4eadc42e60e541

Comments