MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf
SHA3-384 hash: 6ac009acdd605f3b4cff8459371f3089d5e5f8801af0cea8bfdf07584ae36281fa8e99774c0a56a678a2a3edb4c317ea
SHA1 hash: d9e05a92b6edc27a491fced696eb77a7295510ab
MD5 hash: 38f6f05d0bff28a29420efaec6aeab43
humanhash: lima-ten-jupiter-bakerloo
File name:PURCHASE ORDER.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:589'824 bytes
First seen:2021-01-29 16:35:10 UTC
Last seen:2021-01-29 19:20:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:CxAeI5/DM5JjZGVz6Nat8+WTUUtkuUEjTqa2EKg3O+TDE9W:n39DM5hZGVz6Nat8+WTUUtkuUEjTqa2+
Threatray 18 similar samples on MalwareBazaar
TLSH 82C4C0ADFEBE8C52CC9A037AC6A58B463BB03B12405AD719449344FD6DF3F504162E6B
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: air.nseasy.com
Sending IP: 64.37.52.73
From: CHARLENE YONG <sales@ricoeng.com.sg>
Subject: RE: INQUIRY FOR NEW PURCHASE ORDER (URGENT!)...
Attachment: PURCHASE ORDER.zip (contains "PURCHASE ORDER.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE ORDER.exe
Verdict:
No threats detected
Analysis date:
2021-01-29 16:43:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/851d8a32-e912-454d-9a51-083766c24149

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/114841/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
DNS request
Sending an HTTP GET request
Sending a UDP request
Sending a custom TCP request
Reading critical registry keys
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/594201
Signature
Allocates memory in foreign processes
Binary contains a suspicious time stamp
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnxunrpv6me5dzo6mmyh6xt65wlwuvximt4fjzj27jv3dxdhd6xq._file
Verdict:
suspicious
Similar samples:
0760d3239a1163436238b85852142f3477a87dba6f222737db19d99aa48092a7
SnakeKeylogger
08a9b841c509bb0171f6899c3357e6b2cc47ce64e352315c4a8aaa4961ad0673
SnakeKeylogger
4bfb4ba69396cd0e53407019e30928d4be9257e3b51ed78587123f9a22d23ec5
SnakeKeylogger
5b5242b822fbc961a9b3135ed169399695ab26ee429196917b12a8d651292981
SnakeKeylogger
5cc38d4a28e3609654ae3975d062a71272bdaaa655d998498f2169c7679bb19e
SnakeKeylogger
7892a206704754cf7a094b04b2ad2e28cb7cfd310ad297f0f00a41bc561ebf03
SnakeKeylogger
c26fae9be09bc2ae42201aa17d14288a797ed398c1476246a41366c78961668e
SnakeKeylogger
cc23cae84cc09d7e686fecc6ec480e3b39bd7f74ec7869dbf4b952b38dc846ce
SnakeKeylogger
dcfaf32061b7ac3546b3d618dfea1372195cc4d57ff21de2cf6c918797cfa788
SnakeKeylogger
ea78060a7dd7e2df3a47591cc7503c7dd637c3169ec4c78250a43f3bd3d4a290
SnakeKeylogger
+ 8 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210129-gvmzvcq2e6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Beds Protector Packer
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
1baff33b5e52241b31577cc92daf331d3770bf62577af1d1a3f9b5356a640fc0
MD5 hash:
06328abba3cb2ac9c64f59351f078620
SHA1 hash:
ff425f2858266e742b5907d71b0c1b344bd72a96
Link:
https://www.unpac.me/results/f651d635-746d-4d74-8f6c-7a92a4ae9d85/
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/f651d635-746d-4d74-8f6c-7a92a4ae9d85/
SH256 hash:
63ed28aca6ddb33fee1d7d9457298c55f7a38b5517d8ff1ad92034aad47a9983
MD5 hash:
7fad93c65e5019849366c0e0c8dc6139
SHA1 hash:
f62ac6f9b19e5f22f0c50c8405fa089f2fe84024
Link:
https://www.unpac.me/results/f651d635-746d-4d74-8f6c-7a92a4ae9d85/
SH256 hash:
4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf
MD5 hash:
38f6f05d0bff28a29420efaec6aeab43
SHA1 hash:
d9e05a92b6edc27a491fced696eb77a7295510ab
Link:
https://www.unpac.me/results/f651d635-746d-4d74-8f6c-7a92a4ae9d85/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 04df78ab7b05986efaae01e30cebce6497ed5f9f2c29f9b88e02751d4e9e6e9b

SnakeKeylogger

Executable exe 4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf

(this sample)

  
Dropped by
MD5 cf793a94a7a2c4015bfefc2dcfcb745c
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 04df78ab7b05986efaae01e30cebce6497ed5f9f2c29f9b88e02751d4e9e6e9b
Cape
Cape
https://www.capesandbox.com/analysis/114841/

Comments