MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e12db81b88607cff205464998d3aa4a9cf28b6cc3c1454489f2308c4bcecaa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e12db81b88607cff205464998d3aa4a9cf28b6cc3c1454489f2308c4bcecaa1
SHA3-384 hash: 75a9a6fb811e046f719d9949437776060d7018ba11071e835c21568d9c54af7d38a1682118b7e3dd342f92fd8787987a
SHA1 hash: 07f6917890c8959036e8f63c18b0925e34f9bda1
MD5 hash: 585f0a084f204838af334fd8d68e719b
humanhash: mockingbird-georgia-mike-cold
File name:order 39305.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:479'262 bytes
First seen:2021-05-11 05:46:16 UTC
Last seen:2021-05-11 06:02:06 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:qw2cktiLUxRaziiiJsqwPto8+3M1nHmtGhL9Ir9nU4:giLWYOifqwO806nWyUy4
TLSH 5BA423642FE3A1342B19C0E7B2D2CC1E5599F18458C89E60D4D7EB493F49CFB325A17A
Reporter cocaman
Tags:rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Susanne Kutter<kr@rwheim.de>" (likely spoofed)
Received: "from rwheim.de (unknown [103.133.108.13]) "
Date: "10 May 2021 10:04:07 -0700"
Subject: "order 39305 - YHC"
Attachment: "order 39305.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e12db81b88607cff205464998d3aa4a9cf28b6cc3c1454489f2308c4bcecaa1/
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-05-11 05:47:11 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fyjnxanyqyd474qfizezru5kjkopfc3mypaukrej6iyiys6ozkqq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210511-lfhyf9gtrj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendMessage?chat_id=1637651323
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e12db81b88607cff205464998d3aa4a9cf28b6cc3c1454489f2308c4bcecaa1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 2e12db81b88607cff205464998d3aa4a9cf28b6cc3c1454489f2308c4bcecaa1

(this sample)

SnakeKeylogger

Executable exe 77b2428f92ea96e759547ce8c801ea67f17ddd60f330690331efe6b9f6ac8770

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77b2428f92ea96e759547ce8c801ea67f17ddd60f330690331efe6b9f6ac8770

Comments