MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34391a9feae93d603d89f98c86159dfe9219781d9da9ace0820474a13857f138. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34391a9feae93d603d89f98c86159dfe9219781d9da9ace0820474a13857f138
SHA3-384 hash: 8af09c1472f6884194351e531af17a98fb9ed8a8ed9fefd372403e3133d759fae0a68ab004080657ab261d326080ec1e
SHA1 hash: 4386d690d4da96c3df6b3231fa818b2dbb95fbfc
MD5 hash: a6e188992ea76f8b43aa39cb130ff747
humanhash: summer-delaware-music-william
File name:60220124731.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:39'424 bytes
First seen:2022-02-09 14:30:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:8MnrJIRxclnkdz5YaDj0jPR5cdbKVxf28v1OndvHb8CIYi6CENH9qePfo4iOkR+l:m8k9Tejsmf28NOdvHtIYis9tQwE8X7
Threatray 7'065 similar samples on MalwareBazaar
TLSH T1A803933AB3F86611C1768A36C99E51400BE1EDC5DCC2C549F04B7E57B837BEAAA1E143
File icon (PE):PE icon
dhash icon 10c28c8c84868010 (1 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
SnakeKeylogger payload URL:
http://3.112.243.28/webber/60220124731.png

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/239583/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
DNS request
Running batch commands
Sending an HTTP GET request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/6203d02f4077c8b9a0271374/reports/572a6741-dd89-4573-ab83-2d31c9a29287/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f053b7be-da9c-403b-96f7-4b64dabc1cc4
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/937221
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
Encrypted powershell cmdline option found
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 569697 Sample: 60220124731.exe Startdate: 09/02/2022 Architecture: WINDOWS Score: 100 59 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->59 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 12 other signatures 2->65 8 60220124731.exe 16 7 2->8         started        13 exel.exe 14 3 2->13         started        15 exel.exe 3 2->15         started        process3 dnsIp4 57 3.112.243.28, 49766, 49854, 49855 AMAZON-02US United States 8->57 45 C:\Users\user\AppData\Roaming\...\exel.exe, PE32 8->45 dropped 47 C:\Users\user\...\exel.exe:Zone.Identifier, ASCII 8->47 dropped 49 C:\Users\user\AppData\...\60220124731.exe.log, ASCII 8->49 dropped 73 May check the online IP address of the machine 8->73 75 Encrypted powershell cmdline option found 8->75 77 Injects a PE file into a foreign processes 8->77 17 60220124731.exe 2 8->17         started        21 powershell.exe 9 8->21         started        23 powershell.exe 8 13->23         started        25 powershell.exe 15->25         started        file5 signatures6 process7 dnsIp8 51 checkip.dyndns.org 17->51 53 checkip.dyndns.com 132.226.8.169, 49825, 80 UTMEMUS United States 17->53 55 freegeoip.app 172.67.188.154, 443, 49827 CLOUDFLARENETUS United States 17->55 67 Tries to steal Mail credentials (via file / registry access) 17->67 69 Tries to harvest and steal ftp login credentials 17->69 71 Tries to harvest and steal browser information (history, passwords, etc) 17->71 27 cmd.exe 1 21->27         started        29 conhost.exe 21->29         started        31 cmd.exe 23->31         started        33 conhost.exe 23->33         started        35 cmd.exe 25->35         started        37 conhost.exe 25->37         started        signatures9 process10 process11 39 timeout.exe 1 27->39         started        41 timeout.exe 31->41         started        43 timeout.exe 35->43         started       
Detection:
snakekeylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/34391a9feae93d603d89f98c86159dfe9219781d9da9ace0820474a13857f138/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 14:31:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
16 of 28 (57.14%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gq4rvh7k5e6wapmj7ggimfm572jbs6a5twu2zyecar2kcocx6e4a._file
Verdict:
malicious
Similar samples:
1539f0233510cf0257cd5677405a09c9ab1fec1a959aa93e6e35ae87b66460fd
SnakeKeylogger
29704c1c8f22aefdd760c85d19b71aa22fd35e0506804d629c92611f3df072bc
SnakeKeylogger
2dd269cf117a37d4c7fe03686f7fbc935de3bffcc316bd0352fea4811e6a6cb6
SnakeKeylogger
342506c44d37429ab7b60aac7769abcec411f8013ea3fb88202fefe784c50c35
SnakeKeylogger
6d609fc45514bf9f9ca417aac9f42b01e72300f5c1dafe46dd58f72ab51b81b9
SnakeKeylogger
6f63f6b701569423d41f2172ef070360c2b0dea60df2fb988d7633cc44bbbfa4
SnakeKeylogger
9d8a220a6e3de86924137cc074e02d98c2a4f349644ac22a865c0369182d00d8
SnakeKeylogger
a5873f85a8a3800eb3385730aa55e42df0e5a420b6d7bdfb7934a0872faebd4a
SnakeKeylogger
d2d9084a238e2b96bd743f6e954fc387e3060f3316daf113c9c88f8a7c059c45
SnakeKeylogger
d73d8f99a6704f43c0caaf0b6deb99b3f342f645765bf5ca94f41d5daea31612
SnakeKeylogger
+ 7'055 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/220209-rvrhqsaef8/
Behaviour
outlook_office_path
outlook_win_path
Checks processor information in registry
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
34391a9feae93d603d89f98c86159dfe9219781d9da9ace0820474a13857f138
MD5 hash:
a6e188992ea76f8b43aa39cb130ff747
SHA1 hash:
4386d690d4da96c3df6b3231fa818b2dbb95fbfc
Link:
https://www.unpac.me/results/e99bddd7-195d-4e94-850d-58de173e3285/
Malware family:
Phoenix
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/34391a9feae9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 34391a9feae93d603d89f98c86159dfe9219781d9da9ace0820474a13857f138

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2038687/
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/239583/

Comments