MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50ae9a2c8f31b9a9202a1094d428bd795097290960a0be89f1a4e7f2daa94afe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	50ae9a2c8f31b9a9202a1094d428bd795097290960a0be89f1a4e7f2daa94afe
SHA3-384 hash:	6aa63d90ce8e0428ad647319d132d772a88cfd5525acc2f18b4132538b568fec876c4956e350baa67097bf84898c15e4
SHA1 hash:	bd56557b49f13a92434aed5e97a9da859d383d1b
MD5 hash:	32b0d479b3ed9f78a9b34bc861bca332
humanhash:	undress-queen-bacon-may
File name:	u3k5NfLyW20jVGA.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	1'347'072 bytes
First seen:	2021-03-09 11:56:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	24576:mPch8Vc+o03XhmXMvfvOY9NU/w1KqL/WyhSSnIuPmD0:tahmGuwU/pqL/brnItD
Threatray	9 similar samples on MalwareBazaar
TLSH	A9554A0263B82F96F07D877991A10544D7F3A946D330EA4DBDAD60CF4BA3F518B92B12
Reporter	abuse_ch
Tags:	Endurance exe SnakeKeylogger

abuse_ch

Malspam distributing SnakeKeylogger:

HELO: qproxy6-pub.mail.unifiedlayer.com
Sending IP: 69.89.23.12
From: Ammar Shahbandar <info@arwani.ae>
Subject: RFQ 003-0992-021
Attachment: RFQ 003-0992-021.pdf.gz (contains "u3k5NfLyW20jVGA.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

u3k5NfLyW20jVGA.exe

Verdict:

Malicious activity

Analysis date:

2021-03-09 12:06:23 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/fced403d-f9de-45fd-bc4e-9de67abe2a6b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/123183/

Detection(s):

SecuriteInfo.com.Artemis32B0D479B3ED.7921.1258.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/632679

Signature

Found malware configuration

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected AntiVM_3

Yara detected Beds Obfuscator

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-03-09 08:03:45 UTC

AV detection:

21 of 47 (44.68%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kcxjulepgg42sibkccknikf5pfijokijmcql5cprutt7fwvjjl7a._file

Verdict:

unknown

SnakeKeylogger

4421a7b2ad8cc79ee2a0065b9e33d762078c866f448f521fce325c5999dcee97

SnakeKeylogger

7bfd725d73753a04418764767c8c3a06dca2f8cebb832784fd277b4d409101b1

SnakeKeylogger

7f981b1522382f63b0cfafea746c5a12e904f3fa32b8ddd3028eb8963f1b5384

SnakeKeylogger

abb153b63981c70af34e2aaaf02cc0e98818153738e7c090f29705a984400fe8

SnakeKeylogger

b1ba96e47b4b1982648f7da4f27b91e755d3759448fb476f611dba3192f7b3da

SnakeKeylogger

b73207a354dfcc8c05d43b3e63bbc162dba5e951879e99fa0d45585b635cb92b

SnakeKeylogger

cc9e81d4ffa806c20d8c0a87ecbc0524dfcda0e60f7cdcb6d9ceb2f0ca10d2e5

SnakeKeylogger

d2d50893bb4f2c943c32f834cf6c095e5e4f2e7997b543c1012cf0e74ca8adff

SnakeKeylogger

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210309-6tg6jlqs96/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

f9d949d2f56c449c5d346bb93ed04d38426f563b022dd179ae330dab46682c3b

MD5 hash:

871e23d748ba756eaab5777708f250f8

SHA1 hash:

c9816d4ab38541aaab9aa3eab7cb4898d0b72e4a

Link:

https://www.unpac.me/results/1c2ca7aa-56ae-4119-a38a-ffbd1fa29d30/

SH256 hash:

50ae9a2c8f31b9a9202a1094d428bd795097290960a0be89f1a4e7f2daa94afe

MD5 hash:

32b0d479b3ed9f78a9b34bc861bca332

SHA1 hash:

bd56557b49f13a92434aed5e97a9da859d383d1b

Link:

https://www.unpac.me/results/1c2ca7aa-56ae-4119-a38a-ffbd1fa29d30/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/50ae9a2c8f31b9a9202a1094d428bd795097290960a0be89f1a4e7f2daa94afe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector