MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e
SHA3-384 hash: c7a04aecca2969abd752f19e366a1dcf09f165b6fa4e0eaf04513341c2c85ce62f585b84dcd31c32956bf185a861702a
SHA1 hash: 22a99f51b2c2d9339737c8ba66a87f07dfe9452e
MD5 hash: 615cb722b2f4f9bceac13cac05e7846c
humanhash: mountain-yankee-oxygen-carpet
File name:Swift.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:967'810 bytes
First seen:2023-06-09 08:03:55 UTC
Last seen:2023-06-09 08:06:21 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:hi3p4MNW3m1eyLYGSZSsREeGH5edADBPPxdyvETPTFPMG:ApZneMYiPeIUADdJdAoPhUG
TLSH T159252341790BD579E1EE8F1F2A768FBC0AC8EE35196BF3251151215870E0C2B0BB5AF5
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:SnakeKeylogger SWIFT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Carmen Rosa Cardona <carmenrosa.cardona@laslomas.com.bo>" (likely spoofed)
Received: "from vps-zap1095111-1.zap-srv.com (vps-zap1095111-1.zap-srv.com [5.249.162.47]) "
Date: "6 Jun 2023 05:11:22 -0700"
Subject: "RE: BANK TRANSFER COPY - PIPE SEAMLESS PI FROM TISCO SUPPLY CO.,LIMITED"
Attachment: "Swift.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:bank swift.exe
File size:981'491 bytes
SHA256 hash: cb0641e8f221b483c861a04a2cfa0840e4acf63f93095bc6ce7f250ff344dcea
MD5 hash: 3ca828fc890e816e0328510d4a33129e
MIME type:application/x-dosexec
Signature SnakeKeylogger
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs839.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6482dcf539ba775c46e0b1ba/reports/fe449b91-cffd-4abb-8f3d-0ed9f27a34f9/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e/
Threat name:
Win32.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-06-06 08:44:02 UTC
File Type:
Binary (Archive)
Extracted files:
33
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hkyoec5u6hog5vnco7nqrjriufv3fndvkiiig47ambapezk2wgpa._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/230609-j6p52scd2x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e

(this sample)

SnakeKeylogger

Executable exe cb0641e8f221b483c861a04a2cfa0840e4acf63f93095bc6ce7f250ff344dcea

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb0641e8f221b483c861a04a2cfa0840e4acf63f93095bc6ce7f250ff344dcea
  
Dropping
MD5 3ca828fc890e816e0328510d4a33129e

Comments