MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fedd27246a6fdcdd55fe0076a73eb3f0c5478b002443a4f90a0f942f929fa85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fedd27246a6fdcdd55fe0076a73eb3f0c5478b002443a4f90a0f942f929fa85
SHA3-384 hash: 9481ebb96a9346e438b02589e589e33d70d35352603e3664b709cb11853b446d6cd58d3335654ccbb5d9c162cb64b0a8
SHA1 hash: 02d6f52f080d372c2677efbe9a6e1ee5a12b2f8d
MD5 hash: de6de5b3530e9128e29a11caf4bdafb1
humanhash: ohio-nuts-oklahoma-ceiling
File name:WDP7RB-RFQ.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:602'624 bytes
First seen:2022-06-05 08:04:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:6rAasUUcaNp4+bE1viNHo+SpIGjL4BmsSKLlzpG5Q2c6:6EFUUcaN5AvipE2GjhCzpG5Q
Threatray 3'386 similar samples on MalwareBazaar
TLSH T135D4D090C3DBECF2F0146077AD21B19C2724562E95D1CD3A9D9CB58E30A160B29FBE5E
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon e4ccccccd4c4cccc (10 x Formbook, 10 x AgentTesla, 5 x Loki)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
WDP7RB-RFQ.exe
Verdict:
Malicious activity
Analysis date:
2022-06-05 09:10:23 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/a21ca9a4-5bbf-4bbf-9b39-aaa6036430b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/276716/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1364.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/629c6398704da713c66ca928/reports/b486ddb1-fbe4-4a99-8517-d1a74f977182/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0be86162-2b01-4eb2-8751-e2590cf5e3fd
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1006897
Signature
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 639391 Sample: WDP7RB-RFQ.exe Startdate: 05/06/2022 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 8 other signatures 2->49 7 WDP7RB-RFQ.exe 7 2->7         started        process3 file4 31 C:\Users\user\AppData\...31UvTtHgYGZOlq.exe, PE32 7->31 dropped 33 C:\Users\user\AppData\Local\...\tmp66E3.tmp, XML 7->33 dropped 35 C:\Users\user\AppData\...\WDP7RB-RFQ.exe.log, ASCII 7->35 dropped 51 May check the online IP address of the machine 7->51 53 Uses schtasks.exe or at.exe to add and modify task schedules 7->53 55 Adds a directory exclusion to Windows Defender 7->55 57 Injects a PE file into a foreign processes 7->57 11 WDP7RB-RFQ.exe 7->11         started        14 powershell.exe 23 7->14         started        16 powershell.exe 25 7->16         started        18 schtasks.exe 7->18         started        signatures5 process6 dnsIp7 37 checkip.dyndns.com 132.226.247.73, 49760, 80 UTMEMUS United States 11->37 39 checkip.dyndns.org 11->39 41 192.168.2.1 unknown unknown 11->41 20 WerFault.exe 11->20         started        23 conhost.exe 14->23         started        25 conhost.exe 16->25         started        27 conhost.exe 18->27         started        process8 file9 29 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->29 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fedd27246a6fdcdd55fe0076a73eb3f0c5478b002443a4f90a0f942f929fa85/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-06-05 01:05:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
19 of 26 (73.08%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h7w5e4sgu3643vk74adwu47lh4gfi6fqajcdut4qud4uf6jj7kcq._file
Verdict:
malicious
Similar samples:
67e219fbe6dc8c1d1fa466a2b218f1f540f6f98ebebd3ac5adb4142aceff8296
SnakeKeylogger
90280c7a3af8de5451e55f58d30d64572df9c0431471bb084292d202263126f8
SnakeKeylogger
aade9e4c1ff0e22d68b3c1c2a051c7ebc2bf83eb18bfe4c17394ba96af76bda4
SnakeKeylogger
b1fe2bbd10b5fe7733eb80b097a529523745c19089a8eb4202d5883f40383894
SnakeKeylogger
cc39c2e2e46ff137180212485fdc4fa4251418c17e0c92b778dc10989cf16e02
SnakeKeylogger
d0710b3bd45bedf8f5a2b6e2447c616f7afe69b11eeb8bff720e5805b443ef35
SnakeKeylogger
d46778151a7c8f1cb090cf952dadb97acfa1c17e4a6276d44f33547b4bec37e1
SnakeKeylogger
db01c721240ccabd4d4679fe63ff5b80ea7a7c770a5d450506fcbc4b79093a31
SnakeKeylogger
+ 3'376 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220605-jyvesshbd8/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
b1c7e5fc3b09ac7bdec6d5bfec69811ab95e87ca2ae00eb64c340eb90ba3c0dc
MD5 hash:
1dd72bd2bf94aa99f73761b4dea28782
SHA1 hash:
f1327f29a175c8a1cf0b15c7a9328a50aa4ffa41
Link:
https://www.unpac.me/results/9164a715-6df3-48f8-ac8c-1ecf930b7038/
SH256 hash:
5645ed79d6d9cee1ad6ce381f6277bc63622e493ada17bcee395f983a1ab71a8
MD5 hash:
f7c97c9958690b16d1efda5f0f456c02
SHA1 hash:
c5d05ab8a592fedd6f4e2f24ff0c21184d417d03
Link:
https://www.unpac.me/results/9164a715-6df3-48f8-ac8c-1ecf930b7038/
SH256 hash:
746065f1fe3ede63cbf75a2e1db9c62bf9cdcdbd3cbfcee86cb6ead19b3021ae
MD5 hash:
82dd075b342f47334f9ee85c05ae5bf1
SHA1 hash:
2620b9d9d35423b43ebf144fa520104eb41ca0c2
Link:
https://www.unpac.me/results/9164a715-6df3-48f8-ac8c-1ecf930b7038/
SH256 hash:
879c29560b21be7d9b69ca27ca4756df86e080fa3e34cb191aad5cb1e5f05504
MD5 hash:
30b6a54a992eae921a2eb8c5ea130911
SHA1 hash:
1c83f0319bffe007077c6656418c9b7344d5affe
Link:
https://www.unpac.me/results/9164a715-6df3-48f8-ac8c-1ecf930b7038/
SH256 hash:
3fedd27246a6fdcdd55fe0076a73eb3f0c5478b002443a4f90a0f942f929fa85
MD5 hash:
de6de5b3530e9128e29a11caf4bdafb1
SHA1 hash:
02d6f52f080d372c2677efbe9a6e1ee5a12b2f8d
Link:
https://www.unpac.me/results/9164a715-6df3-48f8-ac8c-1ecf930b7038/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3fedd27246a6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3fedd27246a6fdcdd55fe0076a73eb3f0c5478b002443a4f90a0f942f929fa85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 3fedd27246a6fdcdd55fe0076a73eb3f0c5478b002443a4f90a0f942f929fa85

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/276716/

Comments