MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a60a6de5d19273cc8f6b571f08c33ab6ba36249a8b25af8ff08e9e31cf26304. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a60a6de5d19273cc8f6b571f08c33ab6ba36249a8b25af8ff08e9e31cf26304
SHA3-384 hash: f9fddb7e073bec4a20d1a29733d146ce3c48683b240b3ab614e0c9afdbf995785ebdc1d24dba5b1364e8099e1d6e9090
SHA1 hash: f00adc51cedec8e354e571092179d578c3edad0b
MD5 hash: a3ccddd23636c56b73df03ec7f469eed
humanhash: louisiana-california-hawaii-lactose
File name:DHL DOC 74653898.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:876'544 bytes
First seen:2022-10-05 09:31:17 UTC
Last seen:2022-10-06 06:09:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'646 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:1PSR/4verVKQxr4cVv6+G70c5+cPfr5NCb0UnkQ5isOp+BER:hI4vexK2sb0c5nXqY0kGisOIB
Threatray 5'493 similar samples on MalwareBazaar
TLSH T18D15CF3106E2DA0BD5466238DCD3C3F06FE85EA4E676C3474FE9BD6BF04B0A6AA11144
TrID 54.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
23.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
7.8% (.EXE) Win64 Executable (generic) (10523/12/4)
4.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.3% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 74f4c4d4d4d4d4d4 (6 x SnakeKeylogger, 5 x AgentTesla, 5 x Loki)
Reporter abuse_ch
Tags:DHL exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
11
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL DOC 74653898.pdf.lz
Verdict:
Malicious activity
Analysis date:
2022-10-05 11:26:59 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/12618b97-bb0d-4829-a2ae-fe8ccac58ea6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316789/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Launching a process
Creating a file
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633d4f18d5955f6f49d5f27f/reports/acc87a3d-542d-42d7-9a5d-67abc638241a/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b69d547d-157a-4265-98ca-1e9372ed91a4
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1083987
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a60a6de5d19273cc8f6b571f08c33ab6ba36249a8b25af8ff08e9e31cf26304/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-10-05 03:44:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
20 of 26 (76.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjqknxs5dettzshwwvy7bdbtvnv2gysjvczfv6h7bdu6ghhsmmca._file
Verdict:
malicious
Similar samples:
2d4807b948984f8b7f170d662a8c055f53420770e82428a9315001d3d420d610
SnakeKeylogger
50da774fda04ec1034035862f80ea8933397e34b66ac58c239c369836e341be0
SnakeKeylogger
658cb26b4f26e4ecf21c85c6138ceb52c614ca4092a69c365d324ff0b4b0d7c0
SnakeKeylogger
7370349d22f65927955d817fde07a3c9e1b5235fe3091278ad6899d8026422e3
SnakeKeylogger
7c0ccddd1e886d81fbcd8e4c62e6d61ce7e78258825a1f2ef1bc7edca4179cd5
SnakeKeylogger
ba7fa01438610d59a23d6daaa7dac208e3a99ff8dd10dfd6d9be2a59d4ff557e
SnakeKeylogger
f293c00ae925b1e3160d4104f35de999a31728aa5b636dd945d2ceb1d5045c01
SnakeKeylogger
f5b5997f3b718acf9ad712558e910e0d0c4777d8882207c05510f6c42cb3013d
SnakeKeylogger
+ 5'483 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/221005-lhl5ladhd4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fea1e375-636a-4e4b-a507-e2c9e8c40405
Unpacked files
SH256 hash:
5bc45d0a94bc37fe16bf08ead7931c13fa0c71fcf1dfa970f020d7f614bd31d0
MD5 hash:
fd9357f37552035d5c4929dc479f8f84
SHA1 hash:
c0a71298ac281b13eec816db279461cf6a289ed8
Link:
https://www.unpac.me/results/4854dc0d-bd50-4fbe-b0a3-22c90d4042b6/
SH256 hash:
fd1451d21b70a2a1bc22d23436ba4221470882e9f9a467ffbf82c3b738c8319f
MD5 hash:
fde81250c43d9324aae592a6f28230d5
SHA1 hash:
a47bbb38c4a9fed54fc3bc70cf16b6e1a15b17ed
Link:
https://www.unpac.me/results/4854dc0d-bd50-4fbe-b0a3-22c90d4042b6/
SH256 hash:
5fbdcb76c77563ed3d729fdca3396169c54443253001cf9b1b6b75a0f75cdcb4
MD5 hash:
629c31e71cfa6aab7a62bef45298816c
SHA1 hash:
932da9270d08d3b97ad1fb75e3d3180481f91096
Link:
https://www.unpac.me/results/4854dc0d-bd50-4fbe-b0a3-22c90d4042b6/
SH256 hash:
e4576aaeaeaa22b85caf8e87cdd217841b6f8d4021b18bc7eae9935d14c4fe0b
MD5 hash:
9a11c49b9e235f4f6f898d13e649af92
SHA1 hash:
4bf7db635181aa2777ff461dbff957d052bd5cd2
Link:
https://www.unpac.me/results/4854dc0d-bd50-4fbe-b0a3-22c90d4042b6/
Parent samples :
f5ab7866190abc14eddca1da11101e7f76ff08abce7c73350f15fd6f5ceda77a
cb2a2ca9c34ed19856b974b65ad163f37e49ab1cbe1471a5eec1db18a6b9c722
1a527a566735a732121f402724300cc3b59577459d80d127433564b4b9eca5a1
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/4854dc0d-bd50-4fbe-b0a3-22c90d4042b6/
SH256 hash:
3a60a6de5d19273cc8f6b571f08c33ab6ba36249a8b25af8ff08e9e31cf26304
MD5 hash:
a3ccddd23636c56b73df03ec7f469eed
SHA1 hash:
f00adc51cedec8e354e571092179d578c3edad0b
Link:
https://www.unpac.me/results/4854dc0d-bd50-4fbe-b0a3-22c90d4042b6/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3a60a6de5d19/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/3a60a6de5d19273cc8f6b571f08c33ab6ba36249a8b25af8ff08e9e31cf26304

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 5e1505442d543e6814563c86ef0c36b1c6165d5121a37de751fb9746dcb218d3

SnakeKeylogger

Executable exe 3a60a6de5d19273cc8f6b571f08c33ab6ba36249a8b25af8ff08e9e31cf26304

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/316789/
  
Dropped by
SHA256 5e1505442d543e6814563c86ef0c36b1c6165d5121a37de751fb9746dcb218d3
  
Dropped by
MD5 b6c9845ffe4f410f0c4150b7b8d866e4

Comments