MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Intelligence 17 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38
SHA3-384 hash: f4f6636092596dbbf95eb882d492101bd78d8c8ed0a9f76a4571718fd6266e3232c2f2ac3de06be80a6485fcb8335cf4
SHA1 hash: 403e7f43a34f8d2caa5f7d61c9fbff2647f41a8e
MD5 hash: 081a51ff05d2c28730280174cc2fa588
humanhash: zebra-white-berlin-california
File name:5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:210'432 bytes
First seen:2024-07-31 09:57:24 UTC
Last seen:2024-11-11 13:35:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:guHbQw5tKM/717jwUPnS21mQbnc+BR0pKREX/WONBuwrhmc7U1iIyxKIhNXOXcau:o+V6uwrhmVzrFqnnAg
Threatray 2'162 similar samples on MalwareBazaar
TLSH T1A124B7023189ACDAE4531DB25CBFD5201169BE9E5135CA0E3693FB2B55F331230ABB5E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 92b2aca6a6ba8e9e (6 x AgentTesla, 5 x PureCrypter, 4 x SnakeKeylogger)
Reporter JAMESWT_WT
Tags:104-194-143-39 exe SnakeKeylogger zulpine-shop

Intelligence

File Origin
# of uploads :
3
# of downloads :
362
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38
Verdict:
Malicious activity
Analysis date:
2024-07-31 10:00:55 UTC
Tags:
payload evasion snake keylogger netreactor stealer
Link:
https://app.any.run/tasks/9a37360d-41a8-4db7-b115-828f093e34be

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66aa0ab2037b02d0daecb951
Tags:
Discovery Network Stealth Redcap
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP GET request to an infection source
Creating a file in the %AppData% directory
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Connection attempt to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed redcap smartassembly smart_assembly
Link:
https://www.filescan.io/uploads/66aa0ab878d5c73fb1c9e12d/reports/09bd1145-8245-4c81-b919-b798a9a0257e/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/fc9c7bb6-a8e4-4268-ac0f-4164cf7c80f2
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1485267
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1485267 Sample: HJvJi2Pis1.exe Startdate: 31/07/2024 Architecture: WINDOWS Score: 100 21 reallyfreegeoip.org 2->21 23 checkip.dyndns.org 2->23 25 checkip.dyndns.com 2->25 33 Found malware configuration 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 41 7 other signatures 2->41 6 Pdimnuhz.exe 14 4 2->6         started        10 HJvJi2Pis1.exe 16 7 2->10         started        13 Pdimnuhz.exe 5 2->13         started        signatures3 39 Tries to detect the country of the analysis system (by using the IP) 21->39 process4 dnsIp5 27 reallyfreegeoip.org 188.114.96.3, 443, 49722, 49723 CLOUDFLARENETUS European Union 6->27 43 Multi AV Scanner detection for dropped file 6->43 45 Tries to steal Mail credentials (via file / registry access) 6->45 47 Machine Learning detection for dropped file 6->47 49 Tries to harvest and steal browser information (history, passwords, etc) 6->49 29 104.194.143.39, 49714, 49720, 49724 PONYNETUS United States 10->29 31 checkip.dyndns.com 193.122.6.168, 49715, 49721, 49725 ORACLE-BMC-31898US United States 10->31 15 C:\Users\user\AppData\Roaming\Pdimnuhz.exe, PE32 10->15 dropped 17 C:\Users\...\Pdimnuhz.exe:Zone.Identifier, ASCII 10->17 dropped 19 C:\Users\user\AppData\...\HJvJi2Pis1.exe.log, ASCII 10->19 dropped 51 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->51 file6 signatures7
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38/
Threat name:
Win32.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-07-30 12:45:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
21 of 38 (55.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l276m7fzmobn3cwtum565wos2cqkpfwujdkpwnsn7dpkcsynvi4a._file
Verdict:
malicious
Similar samples:
31379f69c7607eb6dbbd2971652840fe8264f1a1dc00f08a564908efead38689
SnakeKeylogger
5ddf2f4417d70accea3b12cd55b5c2ccbaa6c132a1ae00d4dfa5c23cd0f2ec83
SnakeKeylogger
5e47a07fb6cfdaae495014811107380437584762892181314bb3fccf7ec3fafd
SnakeKeylogger
5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38
SnakeKeylogger
6686076964fe6e1599981d06c4c4ced9040a49332bec22ca86b6047ed5e168b4
SnakeKeylogger
93f54d9d24efccdfaf89497d6a2e01b6eb327ff48fe5f53d42f7f3bb0c23fe65
SnakeKeylogger
abcdce91fde094dd2eeafa37e7cf5c8c9a880739b53ed0b882770cd55ee9fc52
SnakeKeylogger
+ 2'152 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection credential_access discovery keylogger persistence spyware stealer
Link:
https://tria.ge/reports/240731-lzg7zascnf/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Credentials from Password Stores: Credentials from Web Browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9a628f19-1793-4808-834c-a28d21c3d50b
Unpacked files
SH256 hash:
5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38
MD5 hash:
081a51ff05d2c28730280174cc2fa588
SHA1 hash:
403e7f43a34f8d2caa5f7d61c9fbff2647f41a8e
Detections:
PureCrypter_Stage1
Create hunting rule
Link:
https://www.unpac.me/results/72330454-4642-4e45-90ec-59e169015835/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5ebfe67cb963/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/5ebfe67cb96382dd8ad3a33beed9d2d0a0a796d448d4fb364df8dea14b0daa38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments