MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5
SHA3-384 hash:	b35197daf7475db8ed09861302d18b9563db4c4b3d0d3cbd1e98e371323b5b63004798915c1a3237034b1e6971c96b37
SHA1 hash:	51c5ee0e97dfef30820a4fd5ccadf1e156763f2e
MD5 hash:	9a9333410d635839092a959d333f7006
humanhash:	snake-finch-monkey-oscar
File name:	SecuriteInfo.com.Win32.TrojanX-gen.830.16107
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	504'320 bytes
First seen:	2023-12-27 18:14:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	6144:qftBXrQwh2qszMOWGoAnfDqvARWvCgsEKPNDyFepTWDvPuAP1OM+TeFUxjkk:wtBEwh2DP7hnfDQBKgQ1eFTDBeTe5k
TLSH	T147B4E009ABD845ECCDEEC5741DFE2AAC23F6C18AC9468F1F1104B5792C6F366215E398
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	SecuriteInfoCom
Tags:	exe SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

405

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

4bcce705c7ea46d6cfede5a86249bc21.eml

Verdict:

Malicious activity

Analysis date:

2023-12-27 19:04:03 UTC

Tags:

evasion snake keylogger

Link:

https://app.any.run/tasks/f4e29008-f2ab-4ce3-9401-3e96b625891d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Snake

Detection:

Snake

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/469473/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.830.16107.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Launching a process

Creating a file

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Reading critical registry keys

Creating a window

Query of malicious DNS domain

Unauthorized injection to a system process

Forced shutdown of a browser

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control lolbin packed

Link:

https://www.filescan.io/uploads/658c69a710642636b38b1a7d/reports/5a728b5f-b3dc-4c8d-a1da-6d3d36ccbdb9/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Snake Keylogger

Malware family:

Snake Keylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3618e197-e690-4ff6-8dc8-130516ec1283

Joe Sandbox Snake Keylogger

Result

Threat name:

Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1367451

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeyLogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeyLogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-27 11:56:32 UTC

File Type:

PE (.Net Exe)

Extracted files:

4

AV detection:

16 of 20 (80.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=icozjzlsaruxqmwsfwh72jekkqs3p7evcrx7byp6qnksgxthf62q._file

Threatray malicious

Verdict:

malicious

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger keylogger stealer

Link:

https://tria.ge/reports/231227-wvwvnscde3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Snake Keylogger

Snake Keylogger payload

UnpacMe snake_keylogger win_404keylogger_g1 MAL_Envrial_Jan18_1 MALWARE_Win_SnakeKeylogger INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_EXE_DotNetProcHook INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unpacked files

SH256 hash:

45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b

MD5 hash:

fb1bc19121c4e190d83672bc71b493f0

SHA1 hash:

c3488b969ba578e28ee360be24b6416425a224a0

Link:

https://www.unpac.me/results/23ca9d01-fda4-4d49-bfcf-63e2e721133e/

SH256 hash:

310b20a5abed2bdd0c8ad7596ff8ae46e6332c356762c71ba6fdf30f813b2071

MD5 hash:

a80bdd93bc7e526ca5e37ab3ab31b3e8

SHA1 hash:

31d916ab6e920790f7f3655e7c54930a0ccade57

Detections:

snake_keylogger

Alert

Create hunting rule

win_404keylogger_g1

Alert

Create hunting rule

MAL_Envrial_Jan18_1

Alert

Create hunting rule

MALWARE_Win_SnakeKeylogger

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Alert

Create hunting rule

Link:

https://www.unpac.me/results/23ca9d01-fda4-4d49-bfcf-63e2e721133e/

Parent samples :

2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b
71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118
f0df0ec243153f35a5522715fb79c372fde175ad98596185ec2eea5a16a535bf
f63b61933ecd47ebf5c5c79fb5e30c89852dc271dab0a6df17015392e1158293
545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d
becd887276df85a4eea5b2837327ee6eea59f0f7579f7894a8307e4681b9b5d4
13f500cb766e4c37869fb3286cbefb2c2ecefb4a799ef7e5723f574a842d5647
ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
fd3215fd4bcb33f2149cd4bed63011c2b992b5a008cdd289559031741e8a3089
43a5ebb280e2770fe10bbb4e598c80456f8fd86b720cf50ecef20d7fbc1423b6
7eebc8928fee351d731226a9abbf7ce6e5833072b18721c603573fc8ff4c6e16
aa733006f49afe10de1ea472aba0b3e8e8192bc59d3a3b244d6953d493e57be9
4e8b17d34495b7e4397939448da55c81d186794fa6a1f00a5e3cbd4659dd74ac
b2ca317d8e7369cd7f839b2db7df1e53b7535ae432ce247e933e8dfa8917e3f5
409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5
dc13c362ff576c7b7733c08175dd2f581ffd40aeb8b090823c18f04ece12ca01
576ca0fbe491aadd6c66a937af35e94d616d9dd9c079b3c7c617fa25b7010700
38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f
d805b874ab77c6272e89f57f5b6f080b039f42064a85778a7ff4bf436575cf68
6a3eefff7806a0b03f089f6b53f17a1db9b6de86cb5c28c798a1b5244fbe7aa8
6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3
8e84d73c7aad92d849e23543da0276e3a1abb8e7c8ea46197bcc01f7b7c4662d
1af4b1e67dee34e1ce541150c83e1be4f75766d47ecebf4b476cb08aa04fa837
5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370
4c91634a53fddb78f1737e66c0c323cdbc8d2e720a14732b8336e449ce062319
8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
7a66c663f71aff27ef5671579fd986b30c9527e23da7cbcfe7cdad8bf8baf739
4cb94e5cf28dc29ec74d5171838ec3735632812576708ec1bf1654b87b18215e
7dca5662fe7621ffd890ac202dd50e9d22b8f2ca186490ad62d8813cc0727cdb
dd2bb6ea65c082f25a75158f22c2d10e3be1daa026334a8d8e06007bbd245f70
b8410c46b62f3f4fa0255c4fa37c4899f2fa7ee69883d35bd178e629e2db24db
d85b912c5171741966d6c8238db04de39b56ed1b696ccf7a32400d34cd29338c
66b79b9bbc034503f2c6330157047506b561d119031d0dd9d03ff87153e01ec5

SH256 hash:

3e65498cdae67e9833fe24049d68e7527e53ff772d57405aacd82647ab0ad2b9

MD5 hash:

fee40c542238ac3d3f645ccf9fe468d6

SHA1 hash:

305ae5d3e657ef987b189bcd6a369681425e3164

Link:

https://www.unpac.me/results/23ca9d01-fda4-4d49-bfcf-63e2e721133e/

SH256 hash:

409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5

MD5 hash:

9a9333410d635839092a959d333f7006

SHA1 hash:

51c5ee0e97dfef30820a4fd5ccadf1e156763f2e

Link:

https://www.unpac.me/results/23ca9d01-fda4-4d49-bfcf-63e2e721133e/

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/409d94e57204/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/469473/