MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fc023c089cb40bd404496c544263b32caf33f3fdd8b335e15fde968d8adcf05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	4fc023c089cb40bd404496c544263b32caf33f3fdd8b335e15fde968d8adcf05
SHA3-384 hash:	53f65ece1388f4ef2053b28abeed097f0c70b83a39519453e72e4c47b714e10229224c858b832e01c61c65d561f52a48
SHA1 hash:	aeb75c3c28c172052e86ae59a3251bbb09f669ea
MD5 hash:	466451c13913cc4dc262ea37a780543b
humanhash:	stairway-eighteen-alanine-summer
File name:	Invoice -89345400MT.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	1'000'960 bytes
First seen:	2021-03-09 11:56:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:F+cWF7hQmhH0GEIGx1i7aB/kw6crmWEfGm4HnPoupcBNYem:F+cG7hAfm7aB/LUf/4HPoupcQ
Threatray	1 similar samples on MalwareBazaar
TLSH	90255C91E12488D6FD274AF37D2F683028D36E9CA4B0550C695AB71B66F3361709EE0F
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

abuse_ch

Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: karadenizliler_algul@hotmail.com
Subject: QUOTE INVOICE
Attachment: Invoice -89345400MT.zip (contains "Invoice -89345400MT.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Invoice -89345400MT.exe

Verdict:

Suspicious activity

Analysis date:

2021-03-09 12:00:44 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0a8d2502-18a1-4716-8ad2-cc490e406268

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/123184/

Detection(s):

SecuriteInfo.com.Artemis466451C13913.28429.21973.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Creating a file

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/632678

Signature

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

May check the online IP address of the machine

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected Beds Obfuscator

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Wacatac

Status:

Malicious

First seen:

2021-03-09 11:57:12 UTC

AV detection:

13 of 47 (27.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=j7achqejznal2qces3cuijr3glfpgpz73wftgxqv7xuwrwfnz4cq._file

Verdict:

unknown

SnakeKeylogger

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210309-qk5gnp9q1a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Beds Protector Packer

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

581567775c2d6fee5ba5510dfeaa260a1a21cf6fe2f5434eff522dee214c91a3

MD5 hash:

ae752a452273a3ede34148026317a66c

SHA1 hash:

fe7cacf6d80e6cfa70ce39b59ab9ad4ecd412567

Link:

https://www.unpac.me/results/bb7e87a0-09c0-4a01-9b49-3cccbc0cb409/

SH256 hash:

97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf

MD5 hash:

8cd28be4bd9a1404c6d3600db32b3ed1

SHA1 hash:

fb90b0ca51118e771390d58b19d0a404ee14cfbc

Link:

https://www.unpac.me/results/bb7e87a0-09c0-4a01-9b49-3cccbc0cb409/

SH256 hash:

96a37c9d52151cfd8d7b4ab2176d228848635e3117e2f7e638c99972015505d8

MD5 hash:

1376ea66a2f76ad74f55a3a12e9531fd

SHA1 hash:

18f939d8e16800bf754412015149aab4f06ef034

Link:

https://www.unpac.me/results/bb7e87a0-09c0-4a01-9b49-3cccbc0cb409/

SH256 hash:

4fc023c089cb40bd404496c544263b32caf33f3fdd8b335e15fde968d8adcf05

MD5 hash:

466451c13913cc4dc262ea37a780543b

SHA1 hash:

aeb75c3c28c172052e86ae59a3251bbb09f669ea

Link:

https://www.unpac.me/results/bb7e87a0-09c0-4a01-9b49-3cccbc0cb409/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4fc023c089cb40bd404496c544263b32caf33f3fdd8b335e15fde968d8adcf05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector