MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a2d743dbef0e04c98f7704269458d98c1c5d363fac04932254f35e1dc2c1821. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	3a2d743dbef0e04c98f7704269458d98c1c5d363fac04932254f35e1dc2c1821
SHA3-384 hash:	4376116382995a3f0018950217b023578e816b3d25f658f195348fc7c0fd4e77558293a44698e64a5acbdc9208b0ed65
SHA1 hash:	75d72201ad1175b933d12f7a54b16ef263e7940d
MD5 hash:	82053b6d9604b51006912808da199017
humanhash:	romeo-indigo-william-lemon
File name:	Pending invoice.rar
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	661'065 bytes
First seen:	2023-04-05 06:06:53 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:rs2JdEeRQ5za25wbaSd6WHHxU5UB538T9fI4O/ig6TBR36MyZ/OPeA:rsWJC522Ozs0ff3QZIZqfW3Z/OPn
TLSH	T12FE423EC8D0EEF7D52E037F59B58EF416488813865177F24B706EC4A5237EE868068AD
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	INVOICE rar SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: "kristina.vainilovich@post.com" (likely spoofed)
Received: "from slot0.eedeka.com (unknown [109.206.243.192]) "
Date: "5 Apr 2023 04:29:48 +0200"
Subject: "RE: Pending invoice"
Attachment: "Pending invoice.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Pending invoice.exe
File size:	1'076'224 bytes
SHA256 hash:	eb9b75de38d85a10701424dccef23e23ed5fe323b52871cde5b4054f4dc6c087
MD5 hash:	49bef31c56451ca1a9cf90908bef2d27
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/3a2d743dbef0e04c98f7704269458d98c1c5d363fac04932254f35e1dc2c1821/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed virus

Link:

https://www.filescan.io/uploads/642d1007497fb6f23efd7bef/reports/247da66b-a790-4ebb-9049-6bf1d452e640/overview

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/3a2d743dbef0e04c98f7704269458d98c1c5d363fac04932254f35e1dc2c1821

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3a2d743dbef0e04c98f7704269458d98c1c5d363fac04932254f35e1dc2c1821/

Threat name:

Win32.Trojan.Pwsx

Status:

Malicious

First seen:

2023-04-05 06:07:06 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 37 (35.14%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hiwxipn66dqezghxobbgsrmntda4lu3d7laesmrfj426dxbmdaqq._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/230405-g2lkyscb42/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot6201063260:AAFNunaDOhtoeTfrWIWz56huyZbdHssBU3s/sendMessage?chat_id=5932819427

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3a2d743dbef0e04c98f7704269458d98c1c5d363fac04932254f35e1dc2c1821

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Suspicious_Macro_Presence Create hunting rule
Author:	Mehmet Ali Kerimoglu (CYB3RMX)
Description:	This rule detects common malicious/suspicious implementations.