MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 16

Intelligence 16 IOCs YARA 13 File information Comments

SHA256 hash:	447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c
SHA3-384 hash:	b2ca40e0b8d84b76f0d2430d5ded2010d6ded8401298685890e93bbaff6c4154ccf49c20fd30793457acaf0cba477baf
SHA1 hash:	a51658f905c74661f556a2de91866ec7d2266e22
MD5 hash:	a814a172ff0d97c6e502b58d3d275c4f
humanhash:	utah-stream-johnny-hawaii
File name:	payment remitted.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	302'927 bytes
First seen:	2023-02-13 07:53:04 UTC
Last seen:	2023-02-13 09:35:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:vYa6SksNY2nQdKhGNGydmVmgn+H9qdp8MJamYP7mK6ovYzAeP:vYsCKYUmgn+dipemYDHDvYzfP
Threatray	7'990 similar samples on MalwareBazaar
TLSH	T1595412467B40C0B7D9729B706D7A9B6E0BF6B02625510B0F2B10761CB6332D5FA6E363
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	lowmal3
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

186

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

payment remitted.exe

Verdict:

Malicious activity

Analysis date:

2023-02-13 07:56:17 UTC

Tags:

evasion trojan snake keylogger

Link:

https://app.any.run/tasks/32f5bcd4-4f0b-403a-a1d7-d60d9a2b06b0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/364862/

Detection(s):

SecuriteInfo.com.Trojan.Garf.Gen.6.9645.17809.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Reading critical registry keys

Unauthorized injection to a recently created process by context flags manipulation

Forced shutdown of a browser

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/68922/overview

Behaviour

MalwareBazaar

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c4a5fa3a-62fe-4f72-9fc8-cec8582066eb

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1173102

Signature

.NET source code references suspicious native API functions

Contains functionality to detect sleep reduction / modifications

Executable has a suspicious name (potential lure to open the executable)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c/

Threat name:

Win32.Trojan.Garf

Status:

Malicious

First seen:

2023-02-13 07:10:51 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 39 (43.59%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ir4hbjgkm6ktttdkfidcs2oe3ocnhqhxoiunharnzdmqwvcyhroa._file

Verdict:

malicious

SnakeKeylogger

3f1d383f87ddadde53543ae6155ce7ef17b543aaa8af6b4953e26a64ae796ce8

SnakeKeylogger

5b8c0c56e48b1a5046c75da4416a009d3c9e00ab046223139551ba6c7126e4a7

SnakeKeylogger

65197e06d709ab4d34cf5b01ee912043bfbf31d919740c59b72ca5ff7740630c

SnakeKeylogger

6769905302dd965b16c74da2c0a5633dd4cbfe5c8879a5db6a7322d53d668533

SnakeKeylogger

8c4cc2077f0eab36be58bb86b34035f1b9c133902630526f609ff0c194f4f236

SnakeKeylogger

dd1ed5209c967dd24b1a861d3eb959a0d52a3ed54a9e0e39685ec5269760f91a

SnakeKeylogger

e60da850d4cf946edd8afe4a6f93953565b55b0f3323357e5136b17b8aaf8c5d

SnakeKeylogger

eea29ccf59fa6a6aa5a3c14360db6068144f14601d987ec37ea21a35cdac9430

SnakeKeylogger

+ 7'980 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/230213-jq1xlsbg84/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot6160036640:AAHqrAdmG4_GQkcLvxoups3k8WSEUC34w1g/sendMessage?chat_id=2052461776

Unpacked files

SH256 hash:

5f56fcbc3220d25ebce8ad0853c6b3d22fdf4ef1e3b1b681eb2286d952616cd7

MD5 hash:

1c348f1397aae26f85000f7d73fd3dbe

SHA1 hash:

e1567eb7ed3d140dd66c477ae51b8e34701d8145

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/bb541fe5-50bb-43f3-9bf0-2c434c24eecf/

SH256 hash:

5003404f45075483c7baa3ac5518e76995862a13f762143f2e1f60fbce58bf16

MD5 hash:

67d4a20e5a1da8df2af1f2f5da4dd15b

SHA1 hash:

a3c96c2b5c4b4eaf79df5b017f1999a358f63b4a

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/bb541fe5-50bb-43f3-9bf0-2c434c24eecf/

Parent samples :

3ef98a92654f2057ba6271f5df8ea83de1f5f1481067525b0102a532a981e71c
33bcce7757b23619ae945f7cd77c16c01001a2602d8fe8e843597e1fc5256c8a
d3deca00c8f354f81845d698cfdf899e475a8ee4d8714fa66a4ade74446debf2
61a349777acbeb0e99b96e08642c2967da2d60a65f2ca511461e642129462c5b
447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c
107b4465806250a6fd7fda62b3ec399b4eaa97a7262bd4a9e13fbe96007ed99e
b3a8ac538be0b9db84f62a419be5bf4240293a5c90dd1cb8fb6cfd1f86356207
375633b4a7abc5d0c92ccbb46a08943b6d27956b9e8d209b791a4a50bf7dfae6
7f4f4a1e2e4d9919c9c50a558278d7a96c035a7c1af19ed44e2f96fbcc842894
fc6948136fe3b70f2516d7f02b785cba33cf29061bda9632de232708f61efe3c
493486c4f573bb9e0d4aa1515ad6797b86caa054c009d814099846321a2233fb
658fced362ebd1582c4153f5e79d7df430ba5f36c1cc1ea8d8281641b4f9f78d
d419eb9ef875e6127b4898ae0bf155ee27c8bb0200da73207d793a08a3ab248a
6e034d943ad1d3f87fe22c3ba4fe32d83415f7ed67bd4c63835318ee0e4f843e
285f52c66b141680b77dcbb20f42a4ee9fab83815bd7c47a0e3cf581dad1404f

SH256 hash:

a5da77b110af8b83d1791814b951db4f57673f349a3e6c60ccb990f3e38f2e9e

MD5 hash:

5b87815b29ead2b03fb23166b710f42a

SHA1 hash:

247630fc00faf667190e2294e41b6337612da362

Link:

https://www.unpac.me/results/bb541fe5-50bb-43f3-9bf0-2c434c24eecf/

SH256 hash:

447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c

MD5 hash:

a814a172ff0d97c6e502b58d3d275c4f

SHA1 hash:

a51658f905c74661f556a2de91866ec7d2266e22

Link:

https://www.unpac.me/results/bb541fe5-50bb-43f3-9bf0-2c434c24eecf/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/447870a4ca67/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

exe 447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/364862/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample