MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 12

Intelligence 12 IOCs YARA 13 File information Comments

SHA256 hash:	4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc
SHA3-384 hash:	6c5d3b3b0f49fbe48dbffdc9e90e4cbdbd5fc12cb226c4e6f04d9d4d601e4bad83b92132d5140d082da23b1cb673142c
SHA1 hash:	96cc96e79bb447307f69242c7614c34963e75ff4
MD5 hash:	9b90a8df932a5ba29b8a0dd3af4a44ea
humanhash:	mirror-william-avocado-michigan
File name:	ORDER 1.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	792'576 bytes
First seen:	2022-12-26 08:45:01 UTC
Last seen:	2022-12-26 10:34:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	12288:Z72UaXsAkkL5Hdk6ELkGR5aUPRpNYtnafKXLcp9b5WxFW:Z6Ua8BBpRNPRpNYtnafK89k
Threatray	10'388 similar samples on MalwareBazaar
TLSH	T1FEF4CFB718B722D1CF920134D67A2C100C0E9AF84B5295B67AE3B66FD6089CD79D4CB7
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	f08f898c8e8a8fb0 (37 x SnakeKeylogger, 19 x AgentTesla, 17 x AveMariaRAT)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

196

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ORDER 1.exe

Verdict:

Malicious activity

Analysis date:

2022-12-26 08:45:36 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/237e79c4-7982-4dd7-b279-46d44913ab83

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.9812.7408.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file

Verdict:

No Threat

Threat level:

2/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63a95f10bf1064ac5b2cba83/reports/5a1b81ae-1d0e-489d-a7f1-083446b0e9db/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d9879b19-f66d-453b-9df9-1a7c042a9b39

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1141043

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-12-26 08:07:47 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jnzzdh2b5jffx7qs3i3qtssvmlxpkug76j3o34ukkjlvgj47ch6a._file

Verdict:

malicious

SnakeKeylogger

495c80adad64f20ab292f42de22850ba2abcc8f9a1c1eb41eda64088fd0bfaa8

SnakeKeylogger

49c9ed92eee655ab544f204f3acbf53eb9f9074434130d2d55f07c89d2791945

SnakeKeylogger

4bb9d6b2fd689b24941493f61b6c39313a35fe7e544a686b69e5a21f38db511c

SnakeKeylogger

7da5ff274247f3936df6b9d2225cc15e8990a4efec62f4f82147071fcab72898

SnakeKeylogger

7f97d04098391576cb56d494a5e59eae649155a4ba10cf490a8d30fa24d3eb93

SnakeKeylogger

b3d857405bc06ef7e5822e4d12f5d7128bf50ba6068553ea90db865b35a19a88

SnakeKeylogger

b5976eb47b7ee86e14820c9ec28dfda460cefbcbcf9936c711512b9fd5260c10

SnakeKeylogger

b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce

SnakeKeylogger

+ 10'378 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/221226-knqjjacf49/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Unpacked files

SH256 hash:

fc6485350cf55dc14ecbfd9b91b7a9979f61023b4104101e9f351caa6c73abaa

MD5 hash:

6c3fdb2b5d93cf814ea1b6ca05a0efcf

SHA1 hash:

f8ae5f9fa1c9b6b0e47b2f0873d2ee3373e0ebf5

Link:

https://www.unpac.me/results/b0c111dd-15ca-4fb8-a7fb-e3ecb48267f7/

SH256 hash:

ea48597853c98b087dff04f19d75a0220966faca97bbe81f81284fbf48f8c514

MD5 hash:

b98a127a09e4015a9c5500e9789f41c7

SHA1 hash:

f21956627f50f96ab6da60ad087fa0f91aa76d63

Link:

https://www.unpac.me/results/b0c111dd-15ca-4fb8-a7fb-e3ecb48267f7/

SH256 hash:

67831417a9445ecc579ac1802f76cfe1a1c813f663ddbdbc7c21926a2210d9d0

MD5 hash:

82d7a0830f7941903acd1df67ae10280

SHA1 hash:

906947993281a8ae16285d4f2dc2f52dab024d07

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/b0c111dd-15ca-4fb8-a7fb-e3ecb48267f7/

Parent samples :

b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce
b5976eb47b7ee86e14820c9ec28dfda460cefbcbcf9936c711512b9fd5260c10
ac74957ffebda2f33603be3668eab0eaeb0deb26874cc2f6f877ef0e2c85cd79
f149ad4d9fc4f3d0dc4cba5a0d1419ad81dc0fd37b179c5bff458ea3666a4c6c
062d1412e5065ad96e3bedcc9a721caf0b2744dde92edd16820c66b8f8679856
725a65de7a17d632eb35dc3e80e1464b1f279218d765cea8f4502c51b6798874
83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db
4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc
eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116
811776b7e88a6f52c43527f71c90981244e6cde742fe45a88c50b15327f5406b
fac6a7623bd40a11274201b5ea609d276e8fd43d82eff03e3136997dbe54c19e

SH256 hash:

47ac7d31590a6bdce9cffc05a299a0d047a889bc542297d10c2f934f55aab58c

MD5 hash:

bfe6b0d4618a9ecdb1267513a4279d55

SHA1 hash:

39a8736b22d293a3ed1c8cd0794703018e9a28c6

Link:

https://www.unpac.me/results/b0c111dd-15ca-4fb8-a7fb-e3ecb48267f7/

SH256 hash:

ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747

MD5 hash:

89ac57478044c57c7195943116a521e0

SHA1 hash:

1ff2bafeed795423e3538d810bda8e1e3fcdcfa5

Link:

https://www.unpac.me/results/b0c111dd-15ca-4fb8-a7fb-e3ecb48267f7/

SH256 hash:

4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc

MD5 hash:

9b90a8df932a5ba29b8a0dd3af4a44ea

SHA1 hash:

96cc96e79bb447307f69242c7614c34963e75ff4

Link:

https://www.unpac.me/results/b0c111dd-15ca-4fb8-a7fb-e3ecb48267f7/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4b73919f41ea/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AsyncRat_Detection_Dec_2022 Create hunting rule
Author:	Potatech
Description:	AsyncRat

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Telegram_APIs Create hunting rule

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample