MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32a00fc9b61a3ca12be1aa91388fbd5c37b19650b01a11d0e5521097b3de3e11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32a00fc9b61a3ca12be1aa91388fbd5c37b19650b01a11d0e5521097b3de3e11
SHA3-384 hash: adfd696db072f41f7d9edaec89d059921197ef9f765ccba5a320972739f21bcfa43d33e0619ccaa3d025e6b7c139b7e2
SHA1 hash: 3a2720f80b8394f0ce859d1dd5566b681252ea84
MD5 hash: be386c47c42d11ab2b0ee2e820297608
humanhash: ink-oregon-comet-king
File name:Xcipfrrs.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:348'672 bytes
First seen:2023-10-13 11:02:47 UTC
Last seen:2023-10-13 11:58:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:QvpJo0XE/ZLUsQqVChyUWmSvoPsasomPFpyit2mHKW2cwOkxStaC8dNH1:ko/qqoU8zsu6stR
Threatray 150 similar samples on MalwareBazaar
TLSH T14E744203E746E8A2E23407B6D4A620548BD2DEC0E76BC60B794973D797127A9FEF1107
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon f2b8c89eb4dcdc78 (19 x SnakeKeylogger, 4 x PureCrypter)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
335
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Xcipfrrs.exe
Verdict:
Malicious activity
Analysis date:
2023-10-13 11:03:14 UTC
Tags:
evasion snake
Link:
https://app.any.run/tasks/e343b8ab-573f-4cd3-98bd-83832ce2d05d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/454107/
Detection(s):
SecuriteInfo.com.Win64.InjectorX-gen.4246.18995.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Launching a process
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/652923e73b921285dcdd8a5a/reports/aca81711-e1d0-443a-a588-9e4406ebb075/overview
Verdict:
Malicious
Labled as:
Trojan.GenericS
Link:
https://www.hybrid-analysis.com/sample/32a00fc9b61a3ca12be1aa91388fbd5c37b19650b01a11d0e5521097b3de3e11
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ab25675-1c96-4bac-a208-c24173c8a8ad
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/32a00fc9b61a3ca12be1aa91388fbd5c37b19650b01a11d0e5521097b3de3e11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32a00fc9b61a3ca12be1aa91388fbd5c37b19650b01a11d0e5521097b3de3e11/
Threat name:
ByteCode-MSIL.Trojan.InjectorX
Create hunting rule
Status:
Malicious
First seen:
2023-10-13 11:03:06 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
7
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkqa7snwdi6kck7bvkitrd55lq33dfsqwanbduhfkiijpm66hyiq._file
Verdict:
malicious
Similar samples:
0634d2afee669d7d5c5193ec04ef7db10b5b9edc9deaa3731143687b8221c6b5
SnakeKeylogger
2f0d1740cabc87f0b68605d72189860b48ea5cf9b8b1570346e996626aec288b
SnakeKeylogger
41ccb4c165200571b2d10047d7e25c85e7a270c2bb6c3438c7f8edce7dc2fc9c
SnakeKeylogger
436f74f3d2537685ed53a9a83ae70cc1a98e987d90ba949ca879a854e2970ed9
SnakeKeylogger
62c1d71fff5293071772735f75960544716be3c3ee5996c6889f3ef3b4e7bcec
SnakeKeylogger
6caab57198e2e3cc5833f0b578e193c99230595f66ab98eb00f0fdae7d8c2c8a
SnakeKeylogger
afea8e29447ebe85480428e2ad947457d515968694dcb5d721886ad1d5945459
SnakeKeylogger
b9d4088106a3a557fb5d909c8c5b921971704d7b764306ee4190cefd9b8d89b0
SnakeKeylogger
c9685a7b02cb597ae2bd974ae1bbdf965f0f89f5e8b1ba43db6bbfcbde620618
SnakeKeylogger
ed57c220f4f3bae36c7116e0997505b04521d9b365879387772a5bd1edb097a5
SnakeKeylogger
+ 140 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery keylogger persistence stealer
Link:
https://tria.ge/reports/231013-m5pdxaae95/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Creates a large amount of network flows
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6380706838:AAHeNJQXD2oljrKM46U8G-Zyq3GHA5SyN3c/sendMessage?chat_id=5262627523
Unpacked files
SH256 hash:
32a00fc9b61a3ca12be1aa91388fbd5c37b19650b01a11d0e5521097b3de3e11
MD5 hash:
be386c47c42d11ab2b0ee2e820297608
SHA1 hash:
3a2720f80b8394f0ce859d1dd5566b681252ea84
Link:
https://www.unpac.me/results/f082561d-2014-41ad-8abf-c2619b216bb0/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/32a00fc9b61a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Author:qux
Description:Detects exe does not have import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/454107/

Comments