MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1
SHA3-384 hash: 3c37900179e0d45666f75b65c68038dfa5b9d14a33314ca41b9f8177369ad9bbd283439b250a48bc5bd3af1eb10b222e
SHA1 hash: 679ea54205c48b9d025e0e9ecf40865a6057cf00
MD5 hash: 73a86a1bf7f9f17ac6d5f0b001a3590d
humanhash: oranges-gee-cardinal-finch
File name:Deliery Order Report.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:838'144 bytes
First seen:2024-01-02 09:14:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:eU6BlXUVUDS+xkyqshMIfESETkCK8L/M05SiWDBwSmT5JD6:0W+uynB89Ty8z5SiMBwv5J
Threatray 266 similar samples on MalwareBazaar
TLSH T17205B13D5BBF122BCC67CAABCBE8DC27B151946B3C11DA6485C3439D5376A4225C322E
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
DE DE
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6593d417f4b6e5e16364a334/reports/8f4e5f38-da74-4fc1-abe0-5c5f1de8b88f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0fd38349-e9c1-4d73-a60e-9b3955bea2fc
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1368710
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
Allocates memory in foreign processes
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-26 07:48:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
18 of 22 (81.82%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ga2sz66mev76f4xnkcahnkk7duw36agqsu3spz5cvanx2rimygqq._file
Verdict:
malicious
Similar samples:
08a1a9925dfe42290e12823fa21cb53cd879fa1895011d2cfa41d1edeb464795
SnakeKeylogger
2cc91aca07118474798c2daad4fc680b057db86e4dca2201da9791a24f53181b
SnakeKeylogger
30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1
SnakeKeylogger
3f58633772463308cda1bb469e94c9d320877e59c939e57be81cf5457b7ac31f
SnakeKeylogger
4cde76ab5dbcd056a0dc49649e7bce6e890f58cd6ba476a0b5f7a4a92d8f685d
SnakeKeylogger
57653821b3827abd3779dcfc3a2d03f480eccf8beab8bc541ecda5aa9dc1bdcc
SnakeKeylogger
+ 256 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/240102-k7wvnaghf6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
0018c0cdaf6f58880005d8df0e7ad30d69f37e8b8dde22ee42d451f4d9a28e66
MD5 hash:
05442e40254a97a89c5e01f5958c73cc
SHA1 hash:
a7182473e974f102a0cec99608a62d21da635b03
Detections:
snake_keylogger
Create hunting rule
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Link:
https://www.unpac.me/results/b334bcaf-d6db-412f-aa74-d51db992dfec/
Parent samples :
30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1
9a51ed2069f54c90bac392ebb1081aa64dee9c2705df9944bc43db671c87dd94
18570b99c7651d0400796686a5bfab737cd43f87228bd7fce152b0cc1027f1cb
504e1940bd93e130262a7bd2b15fb622f178e2b533bfb5514ddc860ea164266d
703921fd2af99761c29876c1593c7f225607a27eabd5bc1e6b66f2d1283de3d9
973ec66ffa4d4679e5efc85f9f4b92c8a17a3b6a41d789a6c976edbca3d6ebd6
SH256 hash:
21afe82a0b71ee589c26f32dc88e0a6e22817f21194b2a83f1807c6cecc8c818
MD5 hash:
440bb4db146ccb1161ac2bcf365d7676
SHA1 hash:
506eda511b46df6e95d86861e70fda81307f8623
Link:
https://www.unpac.me/results/b334bcaf-d6db-412f-aa74-d51db992dfec/
SH256 hash:
b8417b30c9c1e4840227dab4eca556e15d243d73db0692fae9a90d9bfab4d785
MD5 hash:
953e913ce912201d05ecb5f3a0a27d90
SHA1 hash:
3f972a486cc81b997ac957cdefe212c06df924b0
Link:
https://www.unpac.me/results/b334bcaf-d6db-412f-aa74-d51db992dfec/
SH256 hash:
e3d65bd9581460ee982d8040e2376222317843cba4c45e1e8567a4bb2d426f66
MD5 hash:
0a64362f023ad6fb6846acba666136ef
SHA1 hash:
1cf8a0db76830c2a093084e2b04f268648a943de
Link:
https://www.unpac.me/results/b334bcaf-d6db-412f-aa74-d51db992dfec/
SH256 hash:
30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1
MD5 hash:
73a86a1bf7f9f17ac6d5f0b001a3590d
SHA1 hash:
679ea54205c48b9d025e0e9ecf40865a6057cf00
Link:
https://www.unpac.me/results/b334bcaf-d6db-412f-aa74-d51db992dfec/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/30352cfbcc25/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments