MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626
SHA3-384 hash: 39dc7d66e6f274f8c1ffd92d4be8d606f616b4f76bb5621f89ff675cedeae2d5c58255c6b514d01440bd10a3bf2174f6
SHA1 hash: e125c84c0e2e6d2184a30b27cf0edf685a9095d7
MD5 hash: 047b1fff3a3050189e00bce2cef4f183
humanhash: seven-robin-spaghetti-enemy
File name:bank swift... Scan pdf.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:663'599 bytes
First seen:2021-07-19 09:25:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:FiP9VMTCoylipKbGFU8M1l0ZNzgjcJQESDqtgfojmDncJ8hfEQ9+yX9vf:cP9VM7pq8M1luweQ3DW6ojmD5aQ9+yXB
TLSH T19EE42314EC56D3CB36A04EB3495512D62EC7C879B1560BFEFEAB53A5E4CABCE0205093
Reporter cocaman
Tags:SnakeKeylogger SWIFT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "accounts@silitech.be" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.57.176]) "
Date: "19 Jul 2021 11:16:23 +0200"
Subject: "bank swift"
Attachment: "bank swift... Scan pdf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.931.23052.22590.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-19 07:49:50 UTC
File Type:
Binary (Archive)
Extracted files:
30
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqpj5wkwtbqacaqflae4dyzy66zhsxxyaozrkgadjoty2lnq4yta._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210719-szvlgzy2hn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626

(this sample)

SnakeKeylogger

Executable exe 2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4

Comments