MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077
SHA3-384 hash: 8313ee7b55909a241e3395fe58432c10362dfb0f57aaeb7dba087a5fe61721d8584c7cdb076e9301882bccad624b098c
SHA1 hash: e539ad8f06b90105cafd5ce497be6049dd19edde
MD5 hash: 1aa0c36d4fb2ac79a6cb902da1cdf21c
humanhash: undress-early-robert-snake
File name:hesaphareketi-01.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:678'912 bytes
First seen:2023-07-18 12:48:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'628 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:eDv0SxNm1rC5X3NCPYC1zdIIXGo2FwM04sGNn/lBij2l0/eGRYpyuD8Iy/Je/XCr:CMKcZAXdCPYyIbo2t04sGNn/lBij2l0z
Threatray 5'357 similar samples on MalwareBazaar
TLSH T18BE4AED3445493AED97C867AC15B5C672F87FC33C3A0F2156AE8719B09CB2128A6FD09
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 000004c64607390f (3 x AgentTesla, 1 x AveMariaRAT, 1 x Formbook)
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
hesaphareketi-01.exe
Verdict:
Malicious activity
Analysis date:
2023-07-18 12:50:43 UTC
Tags:
evasion snake keylogger trojan
Link:
https://app.any.run/tasks/f0d0c740-c61a-4daf-9c85-9a0990b1e312

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/423485/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.15097.19008.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Creating a window
Forced shutdown of a browser
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker comodo darkkomet packed
Link:
https://www.filescan.io/uploads/64b68a3f2ad0f7418d6a1214/reports/8d908a18-0a1c-4332-87c6-b135f7658285/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/216a9f4a-c2fd-437a-9d41-058f0b27e0fd
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
spre.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1275311
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Drops PE files to the startup folder
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Copy file to startup via Powershell
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1275311 Sample: hesaphareketi-01.exe Startdate: 18/07/2023 Architecture: WINDOWS Score: 100 44 Multi AV Scanner detection for domain / URL 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 11 other signatures 2->50 7 hesaphareketi-01.exe 3 2->7         started        11 anydesk.exe.exe 3 2->11         started        process3 file4 30 C:\Users\user\...\hesaphareketi-01.exe.log, ASCII 7->30 dropped 52 May check the online IP address of the machine 7->52 54 Bypasses PowerShell execution policy 7->54 56 Injects a PE file into a foreign processes 7->56 13 powershell.exe 13 7->13         started        17 hesaphareketi-01.exe 15 2 7->17         started        20 anydesk.exe.exe 14 2 11->20         started        22 powershell.exe 3 11->22         started        24 anydesk.exe.exe 11->24         started        signatures5 process6 dnsIp7 32 C:\Users\user\AppData\...\anydesk.exe.exe, PE32 13->32 dropped 34 C:\Users\...\anydesk.exe.exe:Zone.Identifier, ASCII 13->34 dropped 58 Drops PE files to the startup folder 13->58 60 Powershell drops PE file 13->60 26 conhost.exe 13->26         started        36 checkip.dyndns.org 17->36 38 checkip.dyndns.com 193.122.6.168, 49710, 80 ORACLE-BMC-31898US United States 17->38 40 checkip.dyndns.org 20->40 42 193.122.130.0, 49711, 80 ORACLE-BMC-31898US United States 20->42 62 Tries to steal Mail credentials (via file / registry access) 20->62 64 Tries to harvest and steal browser information (history, passwords, etc) 20->64 28 conhost.exe 22->28         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-18 08:53:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 25 (88.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lfmn4my2bsxleucws43mdyosmnhq5umfezei6tvflz3tdodzyb3q._file
Verdict:
malicious
Similar samples:
0dfed6a80612475d64b34d2c0264f41ee06da61747fd3086786bcbc61212daf3
SnakeKeylogger
2cb7c9dc87cd618a4a307a8f7a054fc0acbb375e0dc2b3d041e5f5b9f138b601
SnakeKeylogger
3105a7886bb62b4a95672ed5a801e8063dfba87139195dfc5a7cfe32f3b4edf2
SnakeKeylogger
5d6c03383955c4784c08bcc14b863537f7fb451fd94a1fe7706b84576fb3819b
SnakeKeylogger
6a6a58b907102aa75633a511d8ed5fad8b89aa637f4ddfb72d8f4cb0d9175166
SnakeKeylogger
71a0f6429f7199e64b3c6d852696a9a8721e6f95598e279f276cfdf22db4e5b5
SnakeKeylogger
b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d
SnakeKeylogger
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SnakeKeylogger
e5fe74a699fdee524980b0ccdfe82a6a98abd5c011ba909822455b831720b686
SnakeKeylogger
+ 5'347 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230718-p2cbaaac85/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6331506862:AAEKFOHP1JKUDc0rSEqmiyzoaDWsXo8zqs4/sendMessage?chat_id=932962718
Unpacked files
SH256 hash:
3890a36e5a7d3a8b7d3eaa9b64edf12fbd34d9779bc5e21d8a5f05aaca252a7e
MD5 hash:
2bddc078ae6de9078705ed8686959adc
SHA1 hash:
a8d1044001df89ab34ec1b2fc89646e65986b1a6
Link:
https://www.unpac.me/results/282f2d97-354c-4d89-8c70-66649665d988/
SH256 hash:
65e47578274d16be1be0f50767bad0af16930df43556dd23d7ad5e4adc2bcbe3
MD5 hash:
848b847cd19805d19235b5acb8ef2bef
SHA1 hash:
38100751a4ae45a143232cbacf9bb441b31fb211
Link:
https://www.unpac.me/results/282f2d97-354c-4d89-8c70-66649665d988/
SH256 hash:
753f470c8a987dc26efc0c804f48249358e3c0440b7d0dd17244ae77ffe2c3db
MD5 hash:
0c337b4ade00b54b752df594cfe4ea79
SHA1 hash:
1c1c59438b05a7fef78b31077f0d8a221bcd7576
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/282f2d97-354c-4d89-8c70-66649665d988/
Parent samples :
6a6a58b907102aa75633a511d8ed5fad8b89aa637f4ddfb72d8f4cb0d9175166
5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077
753f470c8a987dc26efc0c804f48249358e3c0440b7d0dd17244ae77ffe2c3db
SH256 hash:
5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077
MD5 hash:
1aa0c36d4fb2ac79a6cb902da1cdf21c
SHA1 hash:
e539ad8f06b90105cafd5ce497be6049dd19edde
Link:
https://www.unpac.me/results/282f2d97-354c-4d89-8c70-66649665d988/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5958de331a0c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 5958de331a0caeb250569736c1e1d2634f0ed18526488f4ea55e7731b879c077

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/423485/

Comments