MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 355c5863b8fa6110ce14b757584a4541ec1ec39574cf0aade1544dead460d275. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 355c5863b8fa6110ce14b757584a4541ec1ec39574cf0aade1544dead460d275
SHA3-384 hash: 4e34fb46d331c329774832655f187b76c5898fc2eca3f870da77909922bf75633b0b92d9b6197699739d3210cb2fc7c6
SHA1 hash: d21cf8e3386a877a79d868d6f179b398ab7076e2
MD5 hash: 5243faffb593048186bf8e0a60073e86
humanhash: idaho-connecticut-red-alabama
File name:477120227 PURCHASE ORDER.r11
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:638'293 bytes
First seen:2022-07-12 06:17:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:d9uBQwQZM+Xk3mF3U+GcBc3uYLwiuJ+Zfe0ZVJCBezp7yXINlVrhdxW:d9uvXH030c636anQBJINjrhfW
TLSH T1F4D43377B260E63A5670B3D53FCCA0EE077127F36123D0484D6B81651ADE231A1EB2E6
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:r11 rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "OROZCO Cira <cira.orozco@rodiosbo.com>" (likely spoofed)
Received: "from rodiosbo.com (unknown [45.137.22.75]) "
Date: "11 Jul 2022 13:48:07 +0200"
Subject: "None"
Attachment: "477120227 PURCHASE ORDER.r11"

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/355c5863b8fa6110ce14b757584a4541ec1ec39574cf0aade1544dead460d275/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 12:18:32 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gvofqy5y7jqrbtquw5lvqssfihwb5q4vothqvlpbkrg6vvda2j2q._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220712-g2lkyshbe4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/355c5863b8fa6110ce14b757584a4541ec1ec39574cf0aade1544dead460d275

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 355c5863b8fa6110ce14b757584a4541ec1ec39574cf0aade1544dead460d275

(this sample)

SnakeKeylogger

Executable exe c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825
  
Dropping
SnakeKeylogger

Comments