MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2bc4b7908e49fb1b4bcee9fd51702a318423945423b88ce55dd28ef949e2ed27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 15
| SHA256 hash: | 2bc4b7908e49fb1b4bcee9fd51702a318423945423b88ce55dd28ef949e2ed27 |
|---|---|
| SHA3-384 hash: | 2cf517d0126c8558ca7bd9d16943c2f9839c41f9d87754f64221d1f40280ced4a8ad6ce1c8afdc092cdb56a985523ac5 |
| SHA1 hash: | f01917d3ac9397cf878d389b34da3d738894b627 |
| MD5 hash: | b74a162efe4f52f43cc67d126c2f8d77 |
| humanhash: | violet-papa-muppet-network |
| File name: | Ship particular.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 1'061'888 bytes |
| First seen: | 2023-04-08 18:28:05 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:q1ChsCThcQJJTrYJlLs+vjKBUbgh5jBcxG:qwyClcOJTEJNgVFc |
| Threatray | 208 similar samples on MalwareBazaar |
| TLSH | T18B35CFD46AD68BC4C037B130F059CBF2C3D21529E09ADBE1389B5986E1D2E511CFA9BD |
| TrID | 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.1% (.SCR) Windows screen saver (13097/50/3) 8.9% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  James_inthe_box |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
243
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ship particular.exe
Verdict:
Malicious activity
Analysis date:
2023-04-08 18:29:23 UTC
Tags:
snake keylogger trojan evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Launching a process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected BrowserPasswordDump
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-04-07 07:55:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 36 (55.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 198 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
b3b478a4c3f955d2b2c391a95a2a9f4cac5a3b621a4e4205aa337c6972137694
MD5 hash:
a9385b2d17d0f51dc47eba0a50395a22
SHA1 hash:
c52b3ac4a0ebba788a2ec651226c4fb1763dbee5
Detections:
snake_keylogger
SH256 hash:
1a9960c53a382ce1bb2167b101f67341cfc26ac56bc442fc011803521d3a5bb0
MD5 hash:
080938b421d9b4de0930b66c2318b082
SHA1 hash:
69513b125159f3941bc07ae54a99bfe0b16b910f
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
SH256 hash:
ae09f69ae1f8064255a4cc374070d4a882a3abba00639ee1c206eed3f2982e98
MD5 hash:
c75f4fc5f57dcfda371b334c7baa78b0
SHA1 hash:
608bea0ef153549552916b3089ac2b7334b07464
SH256 hash:
47fd73bed8a67c3dd8be1e44429f726a7eebb0b92666a269ae79e99cf0a81568
MD5 hash:
9a0691374a35c1102c06bc81e53b4d72
SHA1 hash:
0c42b2980f2c83460f578d0f3984dceff9bd9954
SH256 hash:
2bc4b7908e49fb1b4bcee9fd51702a318423945423b88ce55dd28ef949e2ed27
MD5 hash:
b74a162efe4f52f43cc67d126c2f8d77
SHA1 hash:
f01917d3ac9397cf878d389b34da3d738894b627
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.