MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aad95eb85a241e4eb97d3d86deb3e43cb6df9df2e0d224a3c1a7701acb0d0a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3aad95eb85a241e4eb97d3d86deb3e43cb6df9df2e0d224a3c1a7701acb0d0a8
SHA3-384 hash: 2b7f0b4bd8182c0dcc2ea58bb725fb4001ee1c7039ccf9f70a692cdd67375a450a09bd869f2f9f17d68af9f6260adba6
SHA1 hash: dc0776583634d29308ea3755660c29b24c47808f
MD5 hash: 1e23ef230083a190e81f7654071f593b
humanhash: johnny-mirror-snake-don
File name:rKskfribdxu.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:60'416 bytes
First seen:2023-07-27 18:52:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 768:sWVeA7Zyqgu/ZFcSg4rZzPYsxX9mi1BeRXlL1XkqgAolrQEB9zbbLHHduTXhj:sWVJlxjcSXrZDY411BmXfMlrQobbLcN
Threatray 2'378 similar samples on MalwareBazaar
TLSH T16E43190332666191C588877BC5DBCE200370EEAA6813CB2F38457F5F7D13BABC95665A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 30f0f4f6e6e461b2 (3 x SnakeKeylogger, 1 x AveMariaRAT, 1 x RemcosRAT)
Reporter FXOLabs
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rKskfribdxu.exe
Verdict:
Malicious activity
Analysis date:
2023-07-27 18:54:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/58adff97-adad-4ccb-92b2-edaff5cf58c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/435619/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader45.62974.22751.25808.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin packed
Link:
https://www.filescan.io/uploads/64c2bd10907b8030b17bba6b/reports/fc5c9b6c-6475-4eeb-8d18-551c7be9263c/overview
Verdict:
Malicious
Labled as:
MSIL/TrojanDownloader.Agent_AGen
Link:
https://www.hybrid-analysis.com/sample/3aad95eb85a241e4eb97d3d86deb3e43cb6df9df2e0d224a3c1a7701acb0d0a8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1fec32f2-52cf-4db3-a6ee-61045e2a21f0
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1281423
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1281423 Sample: rKskfribdxu.exe Startdate: 27/07/2023 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus / Scanner detection for submitted sample 2->45 47 8 other signatures 2->47 6 Yylrhdkrd.exe 14 5 2->6         started        10 rKskfribdxu.exe 16 5 2->10         started        13 Yylrhdkrd.exe 4 2->13         started        process3 dnsIp4 49 Antivirus detection for dropped file 6->49 51 Multi AV Scanner detection for dropped file 6->51 53 Machine Learning detection for dropped file 6->53 15 MSBuild.exe 6->15         started        17 MSBuild.exe 6->17         started        19 MSBuild.exe 6->19         started        27 7 other processes 6->27 39 files.catbox.moe 108.181.20.35, 443, 49717, 49720 ASN852CA Canada 10->39 33 C:\Users\user\AppData\Roaming\Yylrhdkrd.exe, PE32 10->33 dropped 35 C:\Users\...\Yylrhdkrd.exe:Zone.Identifier, ASCII 10->35 dropped 37 C:\Users\user\AppData\...\rKskfribdxu.exe.log, ASCII 10->37 dropped 21 MSBuild.exe 10->21         started        23 MSBuild.exe 10->23         started        25 MSBuild.exe 10->25         started        29 7 other processes 10->29 31 10 other processes 13->31 file5 signatures6 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3aad95eb85a241e4eb97d3d86deb3e43cb6df9df2e0d224a3c1a7701acb0d0a8/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-07-27 10:41:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hkwzl24fuja6j24x2pmg32z6ipfw36o7fygsesr4dj3qdlfq2cua._file
Verdict:
malicious
Similar samples:
037a4e10470f3d1e2a2243f542769a92636c458e07b3fe0597ed38f397d9ce3e
SnakeKeylogger
10c3ade35a4335bd3c404789a75cc98b4b28a12468db7f8fd6e94d468e0bad7e
SnakeKeylogger
134c23ec245a8e10995adfa594154b61bf94e1e5016cf5daeb2b8d594bb16448
SnakeKeylogger
48e372ac62d22a5acca0020a79dfb233b120faf3d84471ff73ecfeec00395ca3
SnakeKeylogger
4e52698dd1dc682040e7d5e1acdd4c14ad648c3618dd103e2361ab805268dfe4
SnakeKeylogger
78883cae0a9462ea71494e0d344aaec468364a4693bc5d908f10b61ea8874d76
SnakeKeylogger
7a1821ad2a4c29cdef49069233eb7cc933d9659d8fb8393f3316f3c954368744
SnakeKeylogger
e03f7cbee9ba8443d200f1bcc47101185dcdc27b965b0ce9b650a0aae4c40492
SnakeKeylogger
f8a98f6720565d1ac05e9c1342e5bd669f46afe61626172cf4a692dd40822294
SnakeKeylogger
+ 2'368 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/230727-xjmcjahg4z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Unpacked files
SH256 hash:
3aad95eb85a241e4eb97d3d86deb3e43cb6df9df2e0d224a3c1a7701acb0d0a8
MD5 hash:
1e23ef230083a190e81f7654071f593b
SHA1 hash:
dc0776583634d29308ea3755660c29b24c47808f
Link:
https://www.unpac.me/results/814c4622-e644-4c60-b45f-7225a6bf93c1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3aad95eb85a241e4eb97d3d86deb3e43cb6df9df2e0d224a3c1a7701acb0d0a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/435619/

Comments