MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c613c7403edd5e27a26a3f5aec588ce9c75806a9ce7892ff6fdfc615f80367e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c613c7403edd5e27a26a3f5aec588ce9c75806a9ce7892ff6fdfc615f80367e
SHA3-384 hash: 6ae713ef9b1023cfa44fa019011aceeae8fd5c92b07190640f346609d28e5879ce4d8a2ec6c1a93001a0e0acb5bd307f
SHA1 hash: d0781ca32fbf607a6d5f4e791b59883881bd2178
MD5 hash: dbb8ee14bfc39cac3c4b224ce08abdbe
humanhash: paris-coffee-thirteen-alabama
File name:SKM37891098 pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:961'024 bytes
First seen:2023-05-09 06:34:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:vplfkrl84la+DFBN445l6LbowIRtAfyTI:vHMrl8GnNF6LEwUyq
Threatray 1'048 similar samples on MalwareBazaar
TLSH T1A7151251B1E9BF96F83E0BF42418B5000BF2316BA9E1F66D4EE651D836E6F400B45D2B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SKM37891098 pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-05-09 06:39:54 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/e014dd8c-f0b9-4203-90cc-ef75262258b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/387678/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo jigsaw packed
Link:
https://www.filescan.io/uploads/6459e9a003238d4c41f21384/reports/1c70407b-6cfc-40e7-9db5-cd41a0cd1085/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/5c613c7403edd5e27a26a3f5aec588ce9c75806a9ce7892ff6fdfc615f80367e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/778d7082-a262-4172-bb77-b9af0c9f7f7c
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1228882
Signature
.NET source code references suspicious native API functions
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected BrowserPasswordDump
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c613c7403edd5e27a26a3f5aec588ce9c75806a9ce7892ff6fdfc615f80367e/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-05-08 15:23:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
51
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lrqty5ad5xk6e6rgup225rmiz2ohladktttysl7w7x6gcx4agz7a._file
Verdict:
malicious
Similar samples:
82acd801b01b749f54598cea752c642b2b47f45dd63fafe53050ed4b06b342a5
SnakeKeylogger
886e952321e1eae1a50c426ea8bff0e574d28a33ce33d85613f8cebfc45c7845
SnakeKeylogger
936e780eba4b7c04267fd9920295dcfce6e5cc6782e75dcd56041d4ea40de60f
SnakeKeylogger
99cf88c829d3c072a3ed4cdd282d9876f4bc32fa3ccfa12180910caa15ba351e
SnakeKeylogger
a5fb447c2992f48abd863452bcd6934032cf29bef1f0907bd9344a31a41e0edb
SnakeKeylogger
cea471b18f25770dc19304e536ca3926c0fbf161c6f64aa018cd077a8a150a1b
SnakeKeylogger
d6280fbc63a14ec4318051d72ad20b7ca0c6391f752264aaac2ecd1685bf746c
SnakeKeylogger
f68d6a0977abf5978dbcc20cfff9fbf9b308ff08c7066e94d0a4a50abc545fc6
SnakeKeylogger
+ 1'038 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230509-hccr7aee85/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6069996781:AAHmYgsHwRzaV1_6EovGh5IzcjEeVnsIkLk/sendMessage?chat_id=1734299596
Unpacked files
SH256 hash:
e22e7f09d743e524d134f4b4bbf5f1eb5308a3edb954a40b8aa5e68c7b8cffd4
MD5 hash:
07e1f7163b7d8b6d80d83d1c819436ef
SHA1 hash:
ed7724c52e18b9810939327b803ca03837915836
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
Parent samples :
1d16237ed75b507f03609ede9722fff429f9a7386c4c4408a9f47623d7a28b50
7154910c217ddc6b6d3726e066d688288efbcd8682a4ad90556fed2ce9009c69
c5dd4dced21baff9499dac6505a77527ac91dc0b0f187c20e9b960b46b3636b9
90dd02313886725b3ad19eaa0780f7189d49e8d1a334e51e5432027e2326c14f
SH256 hash:
fea3e6423e7da01618af7dfbd3c61896933047cce2b8c9dbfb40d5cfbf62b74a
MD5 hash:
c3ccc7c608671a75ca95d18059ee129c
SHA1 hash:
c95622c20a1d784befc158a714c62a433d5886d0
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
SH256 hash:
fc159801a03123ca00ea413fd118a4605518e2213941acb1367eb4244f219e09
MD5 hash:
215e5bab37dfcc0bcb4db6bcde5aaad3
SHA1 hash:
e2b844bf4e979bf05527793cbdc84018ef474428
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
SH256 hash:
24b1d803b715c4ab66051e2c87bef9dcd08a85cc9ab53e04ab60e7dba3d24f9d
MD5 hash:
5f83ee52c6cf6524041aea2a44dcb836
SHA1 hash:
a321bcb2459eaeccf298b1459b05651165e27eee
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
SH256 hash:
a83a9069944b25b9a211d1172e909844639550652246ecfc9b7a3248b2449279
MD5 hash:
6fce79cf8f1a774462939c7a279f9fbe
SHA1 hash:
54f49a90359a95a475308862054daa2b1002cc5c
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
Parent samples :
886e952321e1eae1a50c426ea8bff0e574d28a33ce33d85613f8cebfc45c7845
5c613c7403edd5e27a26a3f5aec588ce9c75806a9ce7892ff6fdfc615f80367e
SH256 hash:
7d4d2727af16bd43a8b84684fcf9471ffac7adb5a99bab3476951c16dcdfa4c3
MD5 hash:
48f25f70764858909ab7fa96721f9d01
SHA1 hash:
1a8628d1c7ea6cf1d06dbfc58cbca14d32139fbd
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
SH256 hash:
a47e4b3e5268b8473155d1213bff32c8a149af3c7d293ac0d13cdbf8f2a7d030
MD5 hash:
7a567fb74c4ff4f0ed9ca818dd348ddb
SHA1 hash:
1496b92932395448e8ccd4dc748f3671a79a45d1
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
SH256 hash:
5c613c7403edd5e27a26a3f5aec588ce9c75806a9ce7892ff6fdfc615f80367e
MD5 hash:
dbb8ee14bfc39cac3c4b224ce08abdbe
SHA1 hash:
d0781ca32fbf607a6d5f4e791b59883881bd2178
Link:
https://www.unpac.me/results/aef78398-3fac-43fa-8b6a-93c5cf2c5254/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5c613c7403ed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 5c613c7403edd5e27a26a3f5aec588ce9c75806a9ce7892ff6fdfc615f80367e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/387678/

Comments