MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d
SHA3-384 hash:	97cce79f3c6131423bb67ddbfcaf6c75b3d7004caf805dd774226b3ee415327691f761467429a5b128716140f84bb4da
SHA1 hash:	479b66af44b11a1c54eea96f83925687876e154e
MD5 hash:	1e55d5fc05a11f4ce243b1ae2cabdb12
humanhash:	sweet-harry-cardinal-victor
File name:	SecuriteInfo.com.Trojan.DownLoader46.43235.24954.653
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	527'872 bytes
First seen:	2023-12-22 03:21:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:UXiF3PPBQI0UnrBGSdbd4dHlCTO3pb2ASHw3dQJZiX:Um3PPBQIBrldYFCT6dSQNgZi
Threatray	5'911 similar samples on MalwareBazaar
TLSH	T1E3B4DF1163E4832EEAF2037879792675AF77FD9B5422C3AE591C703D267331085A63A3
TrID	59.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.6% (.SCR) Windows screen saver (13097/50/3) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	0b1939694d4d6923 (23 x SnakeKeylogger)
Reporter	SecuriteInfoCom
Tags:	exe SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

286

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox Snake

Detection:

Snake

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468900/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.DownLoader46.43235.24954.653.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin masquerade msbuild packed

Link:

https://www.filescan.io/uploads/658500daf4b6e5e163541fec/reports/d75be3a7-bdf4-4fcb-8225-91670499f673/overview

Hybrid Analysis Strictor.Generic

Verdict:

Malicious

Labled as:

Strictor.Generic

Link:

https://www.hybrid-analysis.com/sample/545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Snake Keylogger

Malware family:

Snake Keylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/56581f1d-6ab5-4cad-8a3b-c1534971d836

Joe Sandbox Snake Keylogger

Result

Threat name:

Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1365937

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeyLogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeyLogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-21 11:57:29 UTC

File Type:

PE (.Net Exe)

Extracted files:

7

AV detection:

19 of 23 (82.61%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=krp5wk7k2kjyodolo4kaeinzmvutpd5qxzvj6cvietntwvumez6q._file

Threatray malicious

Verdict:

malicious

Similar samples:

2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b

SnakeKeylogger

48991f467d8b22b9b36a1495de807796386f98fbadf09e01e1d913bf63951d33

SnakeKeylogger

71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118

SnakeKeylogger

f0df0ec243153f35a5522715fb79c372fde175ad98596185ec2eea5a16a535bf

SnakeKeylogger

f63b61933ecd47ebf5c5c79fb5e30c89852dc271dab0a6df17015392e1158293

SnakeKeylogger

+ 5'901 additional samples on MalwareBazaar

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/231222-dwwxysadgq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

UnpacMe snake_keylogger win_404keylogger_g1 MAL_Envrial_Jan18_1 MALWARE_Win_SnakeKeylogger INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_EXE_DotNetProcHook INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unpacked files

SH256 hash:

45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b

MD5 hash:

fb1bc19121c4e190d83672bc71b493f0

SHA1 hash:

c3488b969ba578e28ee360be24b6416425a224a0

Link:

https://www.unpac.me/results/6919de1d-f62d-43b7-a698-1bc970537308/

SH256 hash:

310b20a5abed2bdd0c8ad7596ff8ae46e6332c356762c71ba6fdf30f813b2071

MD5 hash:

a80bdd93bc7e526ca5e37ab3ab31b3e8

SHA1 hash:

31d916ab6e920790f7f3655e7c54930a0ccade57

Detections:

snake_keylogger

Alert

Create hunting rule

win_404keylogger_g1

Alert

Create hunting rule

MAL_Envrial_Jan18_1

Alert

Create hunting rule

MALWARE_Win_SnakeKeylogger

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Alert

Create hunting rule

Link:

https://www.unpac.me/results/6919de1d-f62d-43b7-a698-1bc970537308/

Parent samples :

2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b
71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118
f0df0ec243153f35a5522715fb79c372fde175ad98596185ec2eea5a16a535bf
f63b61933ecd47ebf5c5c79fb5e30c89852dc271dab0a6df17015392e1158293
545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d
becd887276df85a4eea5b2837327ee6eea59f0f7579f7894a8307e4681b9b5d4
13f500cb766e4c37869fb3286cbefb2c2ecefb4a799ef7e5723f574a842d5647
ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
fd3215fd4bcb33f2149cd4bed63011c2b992b5a008cdd289559031741e8a3089
43a5ebb280e2770fe10bbb4e598c80456f8fd86b720cf50ecef20d7fbc1423b6
7eebc8928fee351d731226a9abbf7ce6e5833072b18721c603573fc8ff4c6e16
aa733006f49afe10de1ea472aba0b3e8e8192bc59d3a3b244d6953d493e57be9
4e8b17d34495b7e4397939448da55c81d186794fa6a1f00a5e3cbd4659dd74ac
b2ca317d8e7369cd7f839b2db7df1e53b7535ae432ce247e933e8dfa8917e3f5
409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5
dc13c362ff576c7b7733c08175dd2f581ffd40aeb8b090823c18f04ece12ca01
576ca0fbe491aadd6c66a937af35e94d616d9dd9c079b3c7c617fa25b7010700
38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f
d805b874ab77c6272e89f57f5b6f080b039f42064a85778a7ff4bf436575cf68
6a3eefff7806a0b03f089f6b53f17a1db9b6de86cb5c28c798a1b5244fbe7aa8
6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3
8e84d73c7aad92d849e23543da0276e3a1abb8e7c8ea46197bcc01f7b7c4662d
1af4b1e67dee34e1ce541150c83e1be4f75766d47ecebf4b476cb08aa04fa837
5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370
4c91634a53fddb78f1737e66c0c323cdbc8d2e720a14732b8336e449ce062319
8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
7a66c663f71aff27ef5671579fd986b30c9527e23da7cbcfe7cdad8bf8baf739
4cb94e5cf28dc29ec74d5171838ec3735632812576708ec1bf1654b87b18215e
7dca5662fe7621ffd890ac202dd50e9d22b8f2ca186490ad62d8813cc0727cdb
dd2bb6ea65c082f25a75158f22c2d10e3be1daa026334a8d8e06007bbd245f70
b8410c46b62f3f4fa0255c4fa37c4899f2fa7ee69883d35bd178e629e2db24db
d85b912c5171741966d6c8238db04de39b56ed1b696ccf7a32400d34cd29338c
66b79b9bbc034503f2c6330157047506b561d119031d0dd9d03ff87153e01ec5

SH256 hash:

4c474bff749b8c2b06c73cbd871b5f08d9c0e4f8960069a0587d589d07ac29f0

MD5 hash:

f308cb8401152681291ab81274537e42

SHA1 hash:

0bf058e6f3460281a9c16de9396588dedc043d82

Link:

https://www.unpac.me/results/6919de1d-f62d-43b7-a698-1bc970537308/

SH256 hash:

545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d

MD5 hash:

1e55d5fc05a11f4ce243b1ae2cabdb12

SHA1 hash:

479b66af44b11a1c54eea96f83925687876e154e

Link:

https://www.unpac.me/results/6919de1d-f62d-43b7-a698-1bc970537308/

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/545fdb2bead2/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468900/