MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4c840cf8b8e6ffbd8fd1140e323f898e220a405714353834ce98a1070cbe4a4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 11
| SHA256 hash: | 4c840cf8b8e6ffbd8fd1140e323f898e220a405714353834ce98a1070cbe4a4c |
|---|---|
| SHA3-384 hash: | a27fccfdb391594e30608c7d4eba9928a7fec1f1e419b27fa98f63fda47c464d06bf6aaf4747322f198e102dfaf7dd16 |
| SHA1 hash: | 1c55d367223d7bdd9fb3cd45d2ce6411ddd97c78 |
| MD5 hash: | f096b9024bfafa8e3403a13125c0a6a5 |
| humanhash: | cardinal-foxtrot-batman-fillet |
| File name: | f096b9024bfafa8e3403a13125c0a6a5 |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 283'648 bytes |
| First seen: | 2021-07-07 18:45:06 UTC |
| Last seen: | 2021-07-07 19:44:38 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:WpBRbrWvs2eMBvPdCSHFXGBKqBcRjdPaAW0K0m9S:jRdPdCmFXGBDBOYlEm9 |
| Threatray | 126 similar samples on MalwareBazaar |
| TLSH | T1A354125276AF8A71D056B1B5CCD397041931AF42AADED38F25483FEF7472B0A081A63D |
| Reporter |  zbetcheckin |
| Tags: | 32 exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
01130100370.xlsx
Verdict:
Malicious activity
Analysis date:
2021-07-07 12:47:07 UTC
Tags:
trojan exploit CVE-2017-11882 loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Found malware configuration
Injects a PE file into a foreign processes
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Seraph
Status:
Malicious
First seen:
2021-07-07 05:34:58 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 116 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger keylogger persistence spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
023ba0319744add224f3048542f901f754730300805b279d87357fd67fba6d6a
MD5 hash:
27c9bb43a69cbff045c9ac0058c4f725
SHA1 hash:
92794ad995301b60fce21ae877a04e3c76ccac36
SH256 hash:
a6f8bc3de1120620e28f711f9e377dfd924a5a8197f78c13b29c39775364df79
MD5 hash:
1f8738b48744b398131e338c1448ca25
SHA1 hash:
3c5d27d4b8fafe1dcce8cab9db8f41c13953bcc4
SH256 hash:
00f59d88318fd12f819c68d4c52c9dcfd844b4031c65867c95d1f4fed9bd8607
MD5 hash:
1553798cb98cbc175da187b3c8654444
SHA1 hash:
0ce9a8894039d4896c4dcbd3b983abdad3bc4b15
SH256 hash:
4c840cf8b8e6ffbd8fd1140e323f898e220a405714353834ce98a1070cbe4a4c
MD5 hash:
f096b9024bfafa8e3403a13125c0a6a5
SHA1 hash:
1c55d367223d7bdd9fb3cd45d2ce6411ddd97c78
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://lifestyledrinks.hu/wp-includes/cs2/01130100370.exe