MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5eab60cf69738d99c74d355743502d3c3cd2c987e585396c00f2736792c6c9ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5eab60cf69738d99c74d355743502d3c3cd2c987e585396c00f2736792c6c9ec
SHA3-384 hash: 74fa3dbbdf3ade8a055a4ce2f58e298e3e6c242c8867d994125ecc99ffa758d5987cab52ccf836e1de2a78affb180a43
SHA1 hash: 25b7a90f832afed584b4bb5d2ba4ff899e6e0a65
MD5 hash: 97ff2e05028be30fc18e78528a9d500c
humanhash: glucose-vegan-muppet-nebraska
File name:R F Q.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:811'520 bytes
First seen:2023-05-23 14:04:45 UTC
Last seen:2023-05-23 14:40:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:GTGx0YPX/NqPs4v8SdWNUfOXjVOsrW6N+hbMpOckCIIxrqKBd5eP:GTNHPsDSdWNUfOzV9q4CqcSOKf5eP
Threatray 1'675 similar samples on MalwareBazaar
TLSH T11B05D08376AC4B5DE7594EB539B1E17002B4AF639B22860974E4FD0F7C71A4E7A027C2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon b179696969717169 (1 x SnakeKeylogger)
Reporter threatcat_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
R F Q.exe
Verdict:
Malicious activity
Analysis date:
2023-05-23 14:07:13 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/f045e73e-4332-4ac9-b7da-f10ce4497150

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67166402.15027.6318.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/646cc88866362573b3dd3f77/reports/aa58667a-a4fd-47cf-a5cc-a37403ae9332/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5eab60cf69738d99c74d355743502d3c3cd2c987e585396c00f2736792c6c9ec
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bce51ea3-41fd-4618-88ba-e469e49e6c2f
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1240911
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 873920 Sample: R_F_Q.exe Startdate: 23/05/2023 Architecture: WINDOWS Score: 100 56 Snort IDS alert for network traffic 2->56 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 8 other signatures 2->62 7 FZUTpBn.exe 5 2->7         started        10 R_F_Q.exe 7 2->10         started        process3 file4 64 Antivirus detection for dropped file 7->64 66 Multi AV Scanner detection for dropped file 7->66 68 May check the online IP address of the machine 7->68 70 Machine Learning detection for dropped file 7->70 13 FZUTpBn.exe 14 2 7->13         started        17 schtasks.exe 1 7->17         started        36 C:\Users\user\AppData\Roaming\FZUTpBn.exe, PE32 10->36 dropped 38 C:\Users\user\...\FZUTpBn.exe:Zone.Identifier, ASCII 10->38 dropped 40 C:\Users\user\AppData\Local\...\tmp50CB.tmp, XML 10->40 dropped 42 C:\Users\user\AppData\Local\...\R_F_Q.exe.log, ASCII 10->42 dropped 72 Uses schtasks.exe or at.exe to add and modify task schedules 10->72 74 Adds a directory exclusion to Windows Defender 10->74 19 R_F_Q.exe 15 2 10->19         started        21 powershell.exe 21 10->21         started        23 schtasks.exe 1 10->23         started        25 R_F_Q.exe 10->25         started        signatures5 process6 dnsIp7 46 193.122.6.168, 49699, 80 ORACLE-BMC-31898US United States 13->46 48 checkip.dyndns.org 13->48 76 Tries to steal Mail credentials (via file / registry access) 13->76 78 Tries to harvest and steal ftp login credentials 13->78 80 Tries to harvest and steal browser information (history, passwords, etc) 13->80 27 conhost.exe 17->27         started        50 checkip.dyndns.com 132.226.247.73, 49698, 80 UTMEMUS United States 19->50 52 checkip.dyndns.org 19->52 54 192.168.2.1 unknown unknown 19->54 29 WerFault.exe 19->29         started        32 conhost.exe 21->32         started        34 conhost.exe 23->34         started        signatures8 process9 file10 44 C:\ProgramData\Microsoft\...\Report.wer, Unicode 29->44 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5eab60cf69738d99c74d355743502d3c3cd2c987e585396c00f2736792c6c9ec/
Threat name:
ByteCode-MSIL.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 11:29:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
23 of 37 (62.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2vwbt3joogztr2ngvlugubnhq6nfsmh4wcts3aa6jzwpewgzhwa._file
Verdict:
malicious
Similar samples:
0491bc38e6e0832364a57ee8264c6e7ae42ba800abe522292c8b3c35c1df44d2
SnakeKeylogger
180fb1754473bf66ac639baf329875582efa35331da108954b658107be7f2781
SnakeKeylogger
1950034453da28649135d35016d5ab7ee791cd4bbbc1e4a72f7c56ce3aa9dd9a
SnakeKeylogger
1aad8a04f82d296e91f7fa3d3c0ec03ae6eb0239f1bc43e8d2dbdc70772ccc94
SnakeKeylogger
47c74b216015a03abc6bf2a786c4c760fe23f5ce920c9a0ed6e68aa340568e84
SnakeKeylogger
52a13a4d61a25202abe50d85c42d4b3aac7e364af1100233c28cf06e4598882e
SnakeKeylogger
85574a66e3fbb37b82be9171860a77e52033ca6d877f5eb46011ef5d470cbe93
SnakeKeylogger
8cf00d2afc13dfb147426c04aa2e0f01185ece5cc6d33f0c24dab812fcb2ddc5
SnakeKeylogger
973c7cf900b8d3fe8f945e15c64e4d786a659ea779196a0bb3fa135f3026c70e
SnakeKeylogger
9fb34ea7f261881a74fc5e2b25f1ecf329c16430c9fe5942738d71d0223ae046
SnakeKeylogger
+ 1'665 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230523-rdtlrsfe86/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5439655272:AAGBLlvv-N9cRT8I6adunQ9W-np9xfppm14/sendMessage?chat_id=5477845350
Unpacked files
SH256 hash:
5702eb089122c94979ffee31ac96fb14be28a0eaf628b390d7de1e22786496b6
MD5 hash:
9bb3f331311a869324b4cb4569ee1c1b
SHA1 hash:
e485c59f9d3787f35ed6cc13ba4135c0268b180d
Link:
https://www.unpac.me/results/6d8fbce7-363d-4d0d-a561-5c438e0fd3a7/
SH256 hash:
4c7ce432433fc3a8b0a33d558e0041d3f1c222224c5e61f33104d990a534c7a4
MD5 hash:
e8d756b4e2de5a67446e0b1b80e1bb99
SHA1 hash:
b664448f87ac044a16706d35e5d76538ba79508a
Link:
https://www.unpac.me/results/6d8fbce7-363d-4d0d-a561-5c438e0fd3a7/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/6d8fbce7-363d-4d0d-a561-5c438e0fd3a7/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
aedba75d705ad37f857ea46c53ee3100e7b300ad3700f85642a0dd90098466b6
MD5 hash:
59ffd1c67d1655de7fc94be2da31e1c0
SHA1 hash:
57eee467eae6874a3f8e2bf2edf4db90088c7dca
Link:
https://www.unpac.me/results/6d8fbce7-363d-4d0d-a561-5c438e0fd3a7/
SH256 hash:
bf63e115ee5633d1538941a73895a02b813206e48e9cd1162bcdbc61243137d1
MD5 hash:
63d88208cd531c1869a0f4aeab2cf335
SHA1 hash:
1bbbaf388e87e01ce1d0422b23a742810936ad68
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/6d8fbce7-363d-4d0d-a561-5c438e0fd3a7/
SH256 hash:
5eab60cf69738d99c74d355743502d3c3cd2c987e585396c00f2736792c6c9ec
MD5 hash:
97ff2e05028be30fc18e78528a9d500c
SHA1 hash:
25b7a90f832afed584b4bb5d2ba4ff899e6e0a65
Link:
https://www.unpac.me/results/6d8fbce7-363d-4d0d-a561-5c438e0fd3a7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5eab60cf69738d99c74d355743502d3c3cd2c987e585396c00f2736792c6c9ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 5eab60cf69738d99c74d355743502d3c3cd2c987e585396c00f2736792c6c9ec

(this sample)

  
Dropped by
snakekeylogger
  
Delivery method
Distributed via e-mail attachment

Comments