MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
SHA3-384 hash: 4fcb8458d8222b393aeb3534490098ac41896d8122c058ea6fe1c1f8dadc1ccd1c4e8615bf45cd4880cb5b03c0c1ef23
SHA1 hash: 717145ec136b4f781a38a7879d6f7f373ebebd2d
MD5 hash: 91a3ffc9d6d3bfc43829ca5e2b05d4d6
humanhash: lithium-angel-sweet-johnny
File name:91a3ffc9d6d3bfc43829ca5e2b05d4d6.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:912'896 bytes
First seen:2022-10-06 09:30:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:OUc2iNGR/4veDFjlgtaSpuMN4Ge62pVuXVcReQZE3el:W1e4veD9mtlpQGe1p+gy
Threatray 5'626 similar samples on MalwareBazaar
TLSH T1F015CF25D7A2DA4AD01A1338DCF2C3F06FE85E61E5B9C2075FE9BC1BB4260A75603D85
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
210
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
STS2193092022.xlsx
Verdict:
Malicious activity
Analysis date:
2022-10-05 17:07:50 UTC
Tags:
encrypted opendir exploit cve-2017-11882 loader evasion trojan snake keylogger
Link:
https://app.any.run/tasks/e77caf21-7c10-427f-917f-f66f5cc3ac0e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/317202/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633ea05949c58ce767c65790/reports/1d19da66-ad3e-4efc-ab00-40960b649a80/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/21003603-f26c-4367-b644-b61ba65a57fe
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1085254
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-05 19:00:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
23 of 40 (57.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k5vkakzeqzfsimfpct53w2ky743itn4dw7uraewmwjd263ckfhza._file
Verdict:
malicious
Similar samples:
0cca0bbeb38310bde6f3585ef3d5aa0d45f750851182590231fb7f7d85d2eee6
SnakeKeylogger
2bf3189c9ee98121b1a5b2746f3a46a141990a68ddfa8145ab08b347c6d66502
SnakeKeylogger
480e6eafca7220040b5c881ba63412843e888fb54e21b158a2568bec0cce0acf
SnakeKeylogger
6897412732ce8f38317aefff9c2bb19b15a91caccb0922c53fe29c36474de665
SnakeKeylogger
c1bff6750d2e97e236ec9af546da99de586e947375ca5b70f2004805786eb262
SnakeKeylogger
fa6901852ed9fd26b1adf6140ea9f8fe498edcf73f6b2350f825c10d71783a15
SnakeKeylogger
+ 5'616 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221006-lg2tnagha3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1cdc60c4-1e9d-4774-8312-fa0a49704b64
Unpacked files
SH256 hash:
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
MD5 hash:
21246cfe0f90ff27085d76afa64244c2
SHA1 hash:
f76247ed2d0fdbd4496e3969cfcf6d457cc61fa1
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/5a8d869f-0139-47d4-abc3-eb6edffd358e/
Parent samples :
0a2309336014e8ef72f8e8bcb41902b3c7e56f5c8afa477fda99b1e4f57bb852
0f6df37b515f330df516df24a8023025514d88fea9371ff96491003dffdc9b09
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
f0579298f475e4a98ec491ff10dc3bbab6ceac3b4f376a297ae03d36c177a09d
521e9db681ade0e368a3e99d735333c0d18df6087aa1f2fe6984c84ce1e4a1d8
a3465cca56d61a376078e6ac2d7466fae46bf7d073b9145b768f77ff33a3da0d
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
2afad9ad588a3219b1b36b0096ff4a8db8d70082fd09a612dc6f5935e46f0d4b
73237e3aa90060dbd999b15b39d48db44b63a5d23fd9b2c279fc97cd43a862fe
4832ccbb9379c4046a7478c3cba20a47cb978f37f11ace9afe0d8adb73e17003
9187704232908ac59df2c41f8129eb02fd895817abbce1c6d961a8024ebeb092
6fd62542f92cfcd09af0b2ad8f007a9dc110d64c16cfaab24a9ffd6552a754e8
178f92100449f71a893b39f99b0b3b434d54bd2b2833aaefeb0ab4415f7fb713
df757778956e59dda13ed21877d89a7b55902f285c5958d248300e2e9cfffb83
552b11b82396419c3efd98ecb70657b2d7652d061bbd5d626e478812a65925ee
7b3466885a3f5a38211cd4b6991a384b4a9d8747d5498f4762183e2a48a7fd23
ed31c7e7fc9f786ba9afc2d2885da4db73c4cef7c4514ce69089f57732f5b1ae
68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f
c8b129ddf3b6fbe3a7fe51c48706375b0a3c90711fdbb0111e215076bbfeef58
78f1957ff80044cf3cee3e4efbedbb55f3b64814ed8804fd076822d4ffcbcb6a
17c4cd880779f7dc3b48f6a2e097770b8b078fcc25f06286874233b3fbcb5099
3c78d5139a49e3f81272c1c7e7eae14f22ed3f7e89b8675663a574153d803eef
875ec0c37d9c973142c00da42bb1b6b6e58115cf85ba0e4e231d7bed7df3b21e
fc994ac728ca7b5d34d00f167b331c187110c45d4911572adc1eb279eb158b00
6381387fc80de027985e11c349120a3ee36724617ccbd2fb67b2d72663f8f93e
18743d67309b9042dccd7fc9b27dfdf6860b11745831d891fb64142836e3fc77
1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
585d258b90d3d045c1bd5e5858cc174a51bb25a425612934cd7f167e9a5029af
45ee7fd677dda19356451ef24de0d55b3ccdb5b54c47b5b053a1cf7a280736dc
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd
5bbeb09102c0876fc3d18a31c5aefdfc6f42a4354422611bfefedba2d51da208
cb252bdd63776400aa0f5b41de8ea075a2acb0ef25bcbcc430adb2d356b9e751
489ceb676e0e15e5e5c277ccb679b4508c7ac746e36ec21d4c7d9a52f8f1c88b
SH256 hash:
eddceefa41d2580f866c1b7dfecf331374272544a5cec98d3d909b845390ec3e
MD5 hash:
bd05e135c691449ecf30aa67fec9f2cf
SHA1 hash:
eccf3bc59112fb15fb432b993ce3b0ffc2569229
Link:
https://www.unpac.me/results/5a8d869f-0139-47d4-abc3-eb6edffd358e/
SH256 hash:
5fbdcb76c77563ed3d729fdca3396169c54443253001cf9b1b6b75a0f75cdcb4
MD5 hash:
629c31e71cfa6aab7a62bef45298816c
SHA1 hash:
932da9270d08d3b97ad1fb75e3d3180481f91096
Link:
https://www.unpac.me/results/5a8d869f-0139-47d4-abc3-eb6edffd358e/
SH256 hash:
259253e67633836bd638ed85a2b357834f9d28603a280cddc9d906b26ae88709
MD5 hash:
c10c9077c703bc7d11fcd718e864c4d8
SHA1 hash:
762d4f7df1fa70293b5ec812f600925e2174071c
Link:
https://www.unpac.me/results/5a8d869f-0139-47d4-abc3-eb6edffd358e/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/5a8d869f-0139-47d4-abc3-eb6edffd358e/
SH256 hash:
576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
MD5 hash:
91a3ffc9d6d3bfc43829ca5e2b05d4d6
SHA1 hash:
717145ec136b4f781a38a7879d6f7f373ebebd2d
Link:
https://www.unpac.me/results/5a8d869f-0139-47d4-abc3-eb6edffd358e/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/576aa02b2486/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2350100/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/317202/

Comments