MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5ba70e2cf6910636ffaf66657996ddfd7bdec1d21ac89015a4935a31825106ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 12
| SHA256 hash: | 5ba70e2cf6910636ffaf66657996ddfd7bdec1d21ac89015a4935a31825106ae |
|---|---|
| SHA3-384 hash: | 232b4bd58fbef6774fafff4ded8be01092dbb6387ade9e0e7514048ffec99727325aba203bb1e7c1213f0dbdf3aa7351 |
| SHA1 hash: | 8f5e5cbb89f3273b2163ff6eadcc476e748f06c8 |
| MD5 hash: | ca4fd2fd16e1de5d3964a125c2a3ed8b |
| humanhash: | michigan-nineteen-triple-coffee |
| File name: | ca4fd2fd16e1de5d3964a125c2a3ed8b |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 398'336 bytes |
| First seen: | 2022-07-20 13:51:02 UTC |
| Last seen: | 2022-07-20 14:43:02 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 6144:k1LfxfozBj5bVIacaWO6n2DG09kbCj+cqGT0cAR+rqiSnMA1QWeWJreI0mLvG:U9fozBjpZLWOY6G+j+BwJa4qLbeWeh |
| Threatray | 3'965 similar samples on MalwareBazaar |
| TLSH | T14084231927DC0B2ACF6E5BF91954D5290BF85243AA72D3096D4034CDEEEBF8007897A7 |
| TrID | 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 44e288ae8ace7898 (3 x Formbook, 3 x SnakeKeylogger, 2 x AgentTesla) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-07-20 13:52:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 3'955 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662
Unpacked files
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
SH256 hash:
224caaaaea8d9f8d1e8611ac1666b7402c85e106856b5152a7d2cf3302ab6f54
MD5 hash:
fe2cb133e4664505a4f14638d26eab6a
SHA1 hash:
d1fa98596c0c3ea35e4875eb0a47332295942cfd
SH256 hash:
a53a4d2d3d99905842df37172dd330552761e49cdcd5db8619619b3b189b51f2
MD5 hash:
36f4232a93de753acdb8f0b3a6fa6590
SHA1 hash:
aa9d54e05ce208ca11b34e8956f885334c27247c
SH256 hash:
cca33e028af752b44a3ad612edd024251edd738396e6cbcb712636614d64a3dc
MD5 hash:
2a70684af365233857f364f594f8697b
SHA1 hash:
a4562950fe8828c3e542cdb79457b1853c47d6f1
SH256 hash:
32d6affcdc9dced1fade7679a1958a30a8b0930185472caf0f63f259a9edadbc
MD5 hash:
5562d4f9750ce6f2d92cd3f205d341f0
SHA1 hash:
a175d78771a1f74f4fe4d515d6536a10b65ab14c
SH256 hash:
5ba70e2cf6910636ffaf66657996ddfd7bdec1d21ac89015a4935a31825106ae
MD5 hash:
ca4fd2fd16e1de5d3964a125c2a3ed8b
SHA1 hash:
8f5e5cbb89f3273b2163ff6eadcc476e748f06c8
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://208.67.105.179/yugozx.exe