MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 303a311868f65121392b851d610054b544181e14d697b1151ef0f490e3a8dbd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 303a311868f65121392b851d610054b544181e14d697b1151ef0f490e3a8dbd0
SHA3-384 hash: 1d3480803defd30e4a2d521c73188d869d75360a7d1d96653abd4f971f79e4f10b9a93547e0202d812de326a07e771b1
SHA1 hash: ccdfbafcd141e00bcaa748827142daabdd5729e5
MD5 hash: e99a568ef082bfca5af20fbb88d61e02
humanhash: sodium-artist-princess-skylark
File name:e99a568ef082bfca5af20fbb88d61e02.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:577'536 bytes
First seen:2022-07-05 12:01:12 UTC
Last seen:2022-07-05 13:03:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:yl/HiH1SABePSVM+qINfI67U/EuZH0BKzFUzWSTcz/czb14fMWXDi4s9:ylaVSABZZGcLuZUBKF4T8/czbnuDi4s
Threatray 5'853 similar samples on MalwareBazaar
TLSH T1ADC41224D3F94B62C8BD47FA0150622813F6A3CB3932EB1D8FD574CA5529B804669F7B
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 70f0c4d2d2c4f070 (11 x AgentTesla, 7 x Formbook, 5 x Loki)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.4010.2119.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62c4287edd037e2703315165/reports/20e78df1-62f9-4aa6-a030-11108d187ef3/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/84a25cf8-09b3-48bc-b4e8-071f55000a5b
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1024777
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 657273 Sample: RF63JIXbFO.exe Startdate: 05/07/2022 Architecture: WINDOWS Score: 96 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected Telegram RAT 2->37 39 5 other signatures 2->39 7 RF63JIXbFO.exe 3 2->7         started        process3 file4 25 C:\Users\user\AppData\...\RF63JIXbFO.exe.log, ASCII 7->25 dropped 41 May check the online IP address of the machine 7->41 11 RF63JIXbFO.exe 15 2 7->11         started        14 RF63JIXbFO.exe 7->14         started        16 RF63JIXbFO.exe 7->16         started        18 RF63JIXbFO.exe 7->18         started        signatures5 process6 dnsIp7 27 checkip.dyndns.org 11->27 29 132.226.247.73, 49758, 80 UTMEMUS United States 11->29 31 4 other IPs or domains 11->31 20 WerFault.exe 20 9 11->20         started        process8 file9 23 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->23 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/303a311868f65121392b851d610054b544181e14d697b1151ef0f490e3a8dbd0/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-07-05 05:58:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 26 (76.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ga5dcgdi6ziscojlquowcacuwvcbqhqu22l3cfi66d2jby5i3pia._file
Verdict:
malicious
Similar samples:
1deca3ca80c75f513d42c2d02e4193cdd03f1313d7d5ea3aa6751192989a6e84
SnakeKeylogger
8c8689ef0607b5c400a335514afad5b7f2f549a741ef3c4412c6d20f58aca9f7
SnakeKeylogger
96929d91624ef88554c7850bc57c8cfd2bb093fb8cdaad5f8865c1001c5a5d0d
SnakeKeylogger
97d6ca695325d19dba9161f676434dce87ad47769cb1f5618adc7c5122cf6d1c
SnakeKeylogger
9b575886a26dfe4f3a94ce8b18d308323b9201793790e666bb424de06cfdbd7a
SnakeKeylogger
c4d762c8087c363c890341e5a447ac3552843cbbd850634dbc7f4f37d7469096
SnakeKeylogger
d62400abebfe810e81606b5b269bd81a41d128c4d7ba514b60c1583130757303
SnakeKeylogger
dffe45189680dbc7d56ae5aa90861f798b109efc8cae5a693c0e521b08d2184a
SnakeKeylogger
e2113d1238c6af86ae328bd4292d9fe031ae1a4b142686e392434160619da4fe
SnakeKeylogger
+ 5'843 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220705-n7fp8aagf4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662
Unpacked files
SH256 hash:
b1d1b44d1a7b40b41de657d1e02a1a63b057bac3fd4046a6566d48183621fe1b
MD5 hash:
c1440c222ac7f5fcac59dd1fc56f614a
SHA1 hash:
bf25f8ba89f746a83b6d8bb9182170fa31fd267e
Link:
https://www.unpac.me/results/0e806a35-d3e4-4696-beaf-9ff77062fd15/
SH256 hash:
70bb4f8aa7d0a33f8206f78c845fa2bd686c2a0f2b3bd50cd0b6b887a45398ca
MD5 hash:
30d61a3a3e26c2bca2eb766990132d7c
SHA1 hash:
94f9742d5f21b13f7d8d194fe938193cbb6a0d4d
Link:
https://www.unpac.me/results/0e806a35-d3e4-4696-beaf-9ff77062fd15/
SH256 hash:
3b59fe180dd50e3f3d4fdcbdd4e7a2d4e3e1c85ae43cb4f3716c4be41e9ec2ae
MD5 hash:
9ea556e333e216a65aa09c102f36004f
SHA1 hash:
814c07f1dc68bd61840384aac3aa8346d9f8148f
Link:
https://www.unpac.me/results/0e806a35-d3e4-4696-beaf-9ff77062fd15/
SH256 hash:
c79caa20c549b31dc461793a814f2149c61c9b10e2b94fa9224f9915850a7549
MD5 hash:
a09479c12918797f352f0e4ca44e574b
SHA1 hash:
3bd73a0214af2a1b62a6ba68259b576436adb717
Link:
https://www.unpac.me/results/0e806a35-d3e4-4696-beaf-9ff77062fd15/
SH256 hash:
3f448e25cd3a321c213a811b5e7874dcb5d06e437e9577dd7f2b1d0140b5b833
MD5 hash:
99caffd0119c01691444d4a9a049c0b9
SHA1 hash:
18fd7d70f6b75db5a35582dc73d66e2eee7aa9fc
Link:
https://www.unpac.me/results/0e806a35-d3e4-4696-beaf-9ff77062fd15/
SH256 hash:
303a311868f65121392b851d610054b544181e14d697b1151ef0f490e3a8dbd0
MD5 hash:
e99a568ef082bfca5af20fbb88d61e02
SHA1 hash:
ccdfbafcd141e00bcaa748827142daabdd5729e5
Link:
https://www.unpac.me/results/0e806a35-d3e4-4696-beaf-9ff77062fd15/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/303a311868f6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/303a311868f65121392b851d610054b544181e14d697b1151ef0f490e3a8dbd0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 303a311868f65121392b851d610054b544181e14d697b1151ef0f490e3a8dbd0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2245913/
  
Delivery method
Distributed via web download

Comments