MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40d1d3def95ad310b2aabcfacebcae1be206316be9b006da78092647614dcc95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Maldoc score: 13


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40d1d3def95ad310b2aabcfacebcae1be206316be9b006da78092647614dcc95
SHA3-384 hash: 28eb82ea025b0f96702849d16457b170eb4b4fd3dbb426c4931563bc87fc4f7b2ae589c7eb07e93086c8b2036833db60
SHA1 hash: cf48394f603712907c651a36cd0e2d1b362f9299
MD5 hash: 1e6ea6bd0af320b37d888f2c92400f0d
humanhash: yankee-network-eight-ink
File name:C87b1mDlYqpH306206.xlsm
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:120'285 bytes
First seen:2021-10-28 15:25:55 UTC
Last seen:2021-10-30 05:16:15 UTC
File type:Excel file xlsm
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 3072:DUWs3ziLoxgaSNUPZlsaFPOHYiR+rJEgjjajH7KpmG:gp3ziE/SN0ZltFPgY9rvgKP
TLSH T1B7C3F146A833E67BDE8FA03C38EC62CF9B401011487E197AFB749C8EE3A575D094552E
Reporter abuse_ch
Tags:SnakeKeylogger xlsm

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 13
OLE dump

MalwareBazaar was able to identify 12 sections in this file using oledump:

Section IDSection sizeSection name
A1527 bytesPROJECT
A289 bytesPROJECTwm
A3986 bytesVBA/Sheet1
A45894 bytesVBA/ThisWorkbook
A5988 bytesVBA/Workbook
A62370 bytesVBA/_VBA_PROJECT
A71363 bytesVBA/__SRP_0
A8231 bytesVBA/__SRP_1
A91236 bytesVBA/__SRP_2
A10445 bytesVBA/__SRP_3
A11254 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_ActivateRuns when the Excel Workbook is opened
IOCHfvfjjqbdetbitmifrv.Executable file name code and P-code are different, this may have been used to hide malicious code
SuspiciousOpenMay open a file
SuspiciousOutputMay write to a file (if combined with Open)
SuspiciousShellMay run an executable file or a system command
SuspiciousStrReverseMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
3
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/vnd.ms-excel.sheet.macroEnabled.12
Has a screenshot:
False
Contains macros:
True
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200967/
Detection(s):
MiscreantPunch.EvilMacro.PSHREVRSH.M1.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.PSHELLSPROCB64.2.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.PSHELLNEWOBJECTw.3.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.SHELL.REV.200317.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.MiscreantsTurnBackTime.20210220.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.StringBuilderInTheAirTonight.M2.20210602.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.POWERSHELL.REV.200317.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.NEW-OBJECT.200322B64.3.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.NEW_OBJECT.200630B64.3.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.8.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.START_PROCES.211006B64.7.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CancionDelMariachi.20211020.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Excel File with Macro
Link:
https://app.docguard.net/40d1d3def95ad310b2aabcfacebcae1be206316be9b006da78092647614dcc95/results/dashboard
Document image
Image:
Download PNG
Document image
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/40d1d3def95ad310b2aabcfacebcae1be206316be9b006da78092647614dcc95
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro with File System Write
Detected macro logic that can write data to the file system.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Document With No Content
Document contains little or no semantic information.
Result
Threat name:
Clipboard Hijacker Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/878708
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary or sample is protected by dotNetProtector
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Document contains an embedded VBA macro which may execute processes
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Document exploit detected (creates forbidden files)
Document exploit detected (process start blacklist hit)
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious encrypted Powershell command line found
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Powershell drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Cmdline
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 511143 Sample: C87b1mDlYqpH306206.xlsm Startdate: 28/10/2021 Architecture: WINDOWS Score: 100 94 Malicious sample detected (through community Yara rule) 2->94 96 Antivirus detection for URL or domain 2->96 98 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->98 100 12 other signatures 2->100 10 EXCEL.EXE 76 18 2->10         started        14 taskeng.exe 1 2->14         started        16 FB_319A.tmp.exe 2->16         started        18 2 other processes 2->18 process3 file4 62 C:\Users\user\...\Hfvfjjqbdetbitmifrv.bat, ASCII 10->62 dropped 64 C:\Users\...\C87b1mDlYqpH306206.xlsm. (copy), Microsoft 10->64 dropped 140 Document exploit detected (creates forbidden files) 10->140 20 cmd.exe 10->20         started        23 sergf.exe 1 14->23         started        signatures5 process6 signatures7 102 Malicious encrypted Powershell command line found 20->102 104 Encrypted powershell cmdline option found 20->104 25 powershell.exe 12 7 20->25         started        106 Multi AV Scanner detection for dropped file 23->106 108 Machine Learning detection for dropped file 23->108 110 Tries to delay execution (extensive OutputDebugStringW loop) 23->110 112 Injects a PE file into a foreign processes 23->112 30 sergf.exe 23->30         started        32 cmd.exe 23->32         started        34 cmd.exe 23->34         started        process8 dnsIp9 90 coachcarmenwilliams.com 107.180.51.17, 49167, 80 AS-26496-GO-DADDY-COM-LLCUS United States 25->90 66 C:\Users\user\AppData\Roamingwukwnqjh.exe, Unknown 25->66 dropped 142 Powershell drops PE file 25->142 36 Ewukwnqjh.exe 2 25->36         started        68 C:\Users\user\AppData\...\FB_80A5.tmp.exe, PE32 30->68 dropped 70 C:\Users\user\AppData\...\FB_699B.tmp.exe, PE32 30->70 dropped 39 FB_80A5.tmp.exe 30->39         started        42 FB_699B.tmp.exe 30->42         started        44 schtasks.exe 32->44         started        file10 signatures11 process12 dnsIp13 114 Machine Learning detection for dropped file 36->114 116 Tries to delay execution (extensive OutputDebugStringW loop) 36->116 118 Injects a PE file into a foreign processes 36->118 120 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 36->120 46 Ewukwnqjh.exe 5 36->46         started        49 cmd.exe 36->49         started        52 cmd.exe 1 36->52         started        84 132.226.8.169, 49170, 80 UTMEMUS United States 39->84 86 172.67.188.154, 443, 49171 CLOUDFLARENETUS United States 39->86 88 3 other IPs or domains 39->88 122 Antivirus detection for dropped file 39->122 124 Multi AV Scanner detection for dropped file 39->124 126 May check the online IP address of the machine 39->126 128 3 other signatures 39->128 signatures14 process15 file16 72 C:\Users\user\AppData\...\FB_3BF7.tmp.exe, PE32 46->72 dropped 74 C:\Users\user\AppData\...\FB_319A.tmp.exe, PE32 46->74 dropped 54 FB_3BF7.tmp.exe 12 46->54         started        58 FB_319A.tmp.exe 1 9 46->58         started        92 Uses schtasks.exe or at.exe to add and modify task schedules 49->92 60 schtasks.exe 49->60         started        76 C:\Users\user\AppData\Roaming\...\sergf.exe, PE32 52->76 dropped signatures17 process18 dnsIp19 78 checkip.dyndns.com 193.122.6.168, 49168, 80 ORACLE-BMC-31898US United States 54->78 80 freegeoip.app 104.21.19.200, 443, 49169 CLOUDFLARENETUS United States 54->80 82 checkip.dyndns.org 54->82 130 Antivirus detection for dropped file 54->130 132 Multi AV Scanner detection for dropped file 54->132 134 May check the online IP address of the machine 54->134 136 Tries to steal Mail credentials (via file access) 54->136 138 Machine Learning detection for dropped file 58->138 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40d1d3def95ad310b2aabcfacebcae1be206316be9b006da78092647614dcc95/
Threat name:
Script.Dropper.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2021-10-28 12:09:53 UTC
AV detection:
3 of 44 (6.82%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=idi5hxxzlljrbmvkxt5m5pfodprammll5gyanwtybeteoyknzskq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger macro persistence spyware stealer
Link:
https://tria.ge/reports/211028-s4sylagfaj/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
NTFS ADS
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Deletes itself
Drops startup file
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Process spawned unexpected child process
Snake Keylogger
Malware Config
Dropper Extraction:
http://coachcarmenwilliams.com/C87b1mDlYqpH306206IMG.exe
Malware family:
Phoenix
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/40d1d3def95a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40d1d3def95ad310b2aabcfacebcae1be206316be9b006da78092647614dcc95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:hancitor_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:silentbuilder_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/200967/

Comments