MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4df7854ec37d3d2d2f8b87ef3811ac4b4ea2f16c0d37329a91a4ebeca78337fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4df7854ec37d3d2d2f8b87ef3811ac4b4ea2f16c0d37329a91a4ebeca78337fb
SHA3-384 hash:	783084d8e7d66e362ccedc1a7498be859a80ac358d873110a2b6ce5606823ac38aca938af340c93365954e483f94aba1
SHA1 hash:	b1a3006e144bcf0609554c2659691742b4dbfc62
MD5 hash:	ef481ba2a421968039773e0a0a9a205d
humanhash:	three-alanine-twenty-ten
File name:	#ENQ-1885-23-TCR-AL-AWALIA-2023-RFE-5504.exe
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	575'488 bytes
First seen:	2023-05-12 06:17:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:lqUBrm2wVC4IwSQDEqc4vXk015ZvpNc0gzEIZks8:1dm2wVt+GEwkwvfBgzEZ
Threatray	5'253 similar samples on MalwareBazaar
TLSH	T1FDC4CF44123BBFE2D9A417F0221838524B7DA11A75B8F0BC7D5BB4C9C8AAF114BD4B67
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

325

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

#ENQ-1885-23-TCR-AL-AWALIA-2023-RFE-5504.exe

Verdict:

Malicious activity

Analysis date:

2023-05-12 06:18:02 UTC

Tags:

snake keylogger trojan evasion

Link:

https://app.any.run/tasks/a3770625-a6bd-4ae8-9416-1eb655ee520f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Snake

Detection:

Snake

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/388675/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

barys comodo lokibot packed

Link:

https://www.filescan.io/uploads/645dda1e96ddf417201083ab/reports/81cee5c0-2d1f-478f-b832-44dd10ac4c2b/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/4df7854ec37d3d2d2f8b87ef3811ac4b4ea2f16c0d37329a91a4ebeca78337fb

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Snake Keylogger

Malware family:

Snake Keylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/18a60708-b323-4463-b9a2-1a0d99ae98d7

Joe Sandbox Snake Keylogger

Result

Threat name:

Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1231364

Signature

.NET source code contains potential unpacker

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4df7854ec37d3d2d2f8b87ef3811ac4b4ea2f16c0d37329a91a4ebeca78337fb/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeylogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-11 09:32:55 UTC

File Type:

PE (.Net Exe)

Extracted files:

9

AV detection:

17 of 36 (47.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jx3yktwdpu6s2l4lq7xtqenmjnhkf4lmbu3tfgurutv6zj4dg75q._file

Threatray malicious

Verdict:

malicious

Similar samples:

0143b411f3c0c02a845fa45cca9fd02df3da4334ad748fd119759f877c1e7ef2

SnakeKeylogger

39284637e45691feb034477cb6d51b662892a17b883ce42cee8d8e2fcdda4817

SnakeKeylogger

606157eb85fa1f90ad5b6def0cbddc1445298156aecb9da21bcc925e6cd7638c

SnakeKeylogger

f2919d54bbf74198eb4bf4c43f7cbd394acff9af2e57f7b7ba9e59fd6a57f79c

SnakeKeylogger

+ 5'243 additional samples on MalwareBazaar

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/230512-g2lkysec8s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot5300146648:AAHnGWyIYhkCfGzD7b3SfmLZj94Y8lXxD90/sendMessage?chat_id=5116181161

UnpacMe snake_keylogger

Unpacked files

SH256 hash:

d253e991b0afb6b3e9cfaf8dce2e56c93e6ac838ce8f4a6c1c0b4752527009c6

MD5 hash:

915aa3d78cab8eb6920c2cf8ab39e6a1

SHA1 hash:

f4dc2ac541b600883e4648aafbc92f5e0b1811f0

Detections:

snake_keylogger

Alert

Create hunting rule

Link:

https://www.unpac.me/results/8d9e7600-53aa-426a-bf3b-42f3ff60fd81/

Parent samples :

9432b4cd9f8a31640bf60b6cf8bece39ee0b0f110d2d43e429d9d203e1feaf41
8d31760b4b183db7fbb1cce9c5dab77e264c27484eb49193c6ebd0cc1deeaccf
808af00d1b4ec59a042cfa6d2a46549fca9d2d588847287bab70321622e008cd
05bec361a7f7ce8bb453225e15f0911068f103c51eee5e553f783955f65ed54c
54bae76ab64ae74ef5b97cef8aaffa2ec1254df6fea46d54c1387b6f5d5fb025
b43c354874e511906b2a3abef9db96af2a2d0aec46c8d04fe7357bcebdf03a4f
7e039e4d466d67e2e7fe4cf46aa141db13f2454161ebc86ec1dd02c33113d154
34ae82b3da999e17e5b62fae65be1827e3f6a54c599c68f1a02666772b70eb09
d4086b64b176925017dd2db176cb3754e172bcec944037e1f3ea53ce48c1303f
e6c7bf9f389f560ec25ba1808468c5d334cf75d2142face3704aac05af8c024b
c9234000f8f576a39a7d2a957826094c1c0e37b141ef26ee2e8e36a62e09805a
92f0a55426e5040dc80133f908906acddaa338792783507fb0bb62d5b786c3ce
0f629b4e11087c4e000457daa326269c1ed26198d5a5e8f963d10e0be9dd77a7
4df7854ec37d3d2d2f8b87ef3811ac4b4ea2f16c0d37329a91a4ebeca78337fb
d253e991b0afb6b3e9cfaf8dce2e56c93e6ac838ce8f4a6c1c0b4752527009c6

SH256 hash:

b0bb3a1bea8926b84c9f5376ace25be5bcdc8cc7971c802ec85dca28932f5618

MD5 hash:

714e6c5398d1d0f2050312b373587362

SHA1 hash:

e95e5eb2a7bcb5c128e5f64785e8f8f6ab23f567

Link:

https://www.unpac.me/results/8d9e7600-53aa-426a-bf3b-42f3ff60fd81/

SH256 hash:

a067d5065a66691512fb4b52fa1df3e03db2f22ce7ca15814145f354eb0b9c59

MD5 hash:

a647f69a7adcd9b5d56d8deeba860619

SHA1 hash:

b92cf3b5282f13e5a38ec0d55d69fcb2bccecbf2

Link:

https://www.unpac.me/results/8d9e7600-53aa-426a-bf3b-42f3ff60fd81/

SH256 hash:

d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218

MD5 hash:

e5d93dadd08b8bc727e4f4853c6881ba

SHA1 hash:

27e0e057d33f01586193b0cbf06561c2863951f4

Link:

https://www.unpac.me/results/8d9e7600-53aa-426a-bf3b-42f3ff60fd81/

SH256 hash:

5640723e3ce36a7da4990c0345a233eee79bd040c668e3ef0482ef3830bc97d5

MD5 hash:

caa2fd4180b063525b2adcda16a2fd56

SHA1 hash:

24565eff9b0cd7c509514eabaa426b37144c436a

Link:

https://www.unpac.me/results/8d9e7600-53aa-426a-bf3b-42f3ff60fd81/

SH256 hash:

4df7854ec37d3d2d2f8b87ef3811ac4b4ea2f16c0d37329a91a4ebeca78337fb

MD5 hash:

ef481ba2a421968039773e0a0a9a205d

SHA1 hash:

b1a3006e144bcf0609554c2659691742b4dbfc62

Link:

https://www.unpac.me/results/8d9e7600-53aa-426a-bf3b-42f3ff60fd81/

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4df7854ec37d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/388675/