MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c1c2a6ac96e1ca6a04d7713a76c0d9d30d18798d798831ca4d119dcbc755b88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c1c2a6ac96e1ca6a04d7713a76c0d9d30d18798d798831ca4d119dcbc755b88
SHA3-384 hash: bdd15fce9d5a461ad58baf478aed24333b51c93268b084af4e09ef2cbd29600697b9da17286fef0fbd5832f82a3537fb
SHA1 hash: 449e4384c584955668285f40318694a3b3832217
MD5 hash: f9ec41b86f6e0fc8b7b4708902e218ac
humanhash: july-spring-cup-oxygen
File name:HAIAN RUBBER GROUP CO.,LTD QTTY (PO#7A68D22).pdf.lha
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:318'937 bytes
First seen:2023-02-14 07:47:40 UTC
Last seen:2023-02-14 08:23:33 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:4gC8V5aWe7JWvGia2Pz0G95Laf0XOCQ7j7iOFTL1AELDYoi3j:i8V5IUVa2Iy5LswOrviOHFL0
TLSH T1ED64239A915FE5258498FA13A040EDF9DC0BDAC9150FC6D0B6F27497967CD8FAC8CB02
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:lha rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Karen Zhang <kzhang@haiangroup.com>" (likely spoofed)
Received: "from haiangroup.com (unknown [103.156.91.29]) "
Date: "13 Feb 2023 11:04:01 -0800"
Subject: "NEW PO FROM HAIAN RUBBER GROUP CO.,LTD QTTY (PO#7A68D22),"
Attachment: "HAIAN RUBBER GROUP CO.,LTD QTTY (PO#7A68D22).pdf.lha"

Intelligence

File Origin
# of uploads :
10
# of downloads :
91
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:HAIAN RUBBER GROUP CO.,LTD QTTY (PO#7A68D22).pdf.exe
File size:469'796 bytes
SHA256 hash: 642de5360ff3669d769d18f1372853247895a6d4c0e72a9079869804ace6b15a
MD5 hash: 39622459e8221636e1a45144c6f36561
MIME type:application/x-dosexec
Signature SnakeKeylogger
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20230213-1332.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63eb3cb43d31856c2cc86491/reports/c2ebf9ef-dac9-4e3b-a511-66e627d6e62a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2c1c2a6ac96e1ca6a04d7713a76c0d9d30d18798d798831ca4d119dcbc755b88
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c1c2a6ac96e1ca6a04d7713a76c0d9d30d18798d798831ca4d119dcbc755b88/
Threat name:
Win32.Infostealer.Mintluks
Create hunting rule
Status:
Malicious
First seen:
2023-02-13 12:24:57 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fqocu2wjnyoknicno4j2o3antuyndb4y26mighfe2em5zpdvloea._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230214-k816rsbf3v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6088403113:AAGbasJAZS1yXzT5Hv6KJBlt80Z5QJZiq8Y/sendMessage?chat_id=6128502729
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c1c2a6ac96e1ca6a04d7713a76c0d9d30d18798d798831ca4d119dcbc755b88

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4
Create hunting rule
Author:Florian Roth
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 2c1c2a6ac96e1ca6a04d7713a76c0d9d30d18798d798831ca4d119dcbc755b88

(this sample)

SnakeKeylogger

Executable exe 642de5360ff3669d769d18f1372853247895a6d4c0e72a9079869804ace6b15a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 642de5360ff3669d769d18f1372853247895a6d4c0e72a9079869804ace6b15a
  
Dropping
SnakeKeylogger

Comments