MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6071b387b4dda9da63d4d4e8d6c43c1b156403902c56a77c78389b0f5597f65d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	6071b387b4dda9da63d4d4e8d6c43c1b156403902c56a77c78389b0f5597f65d
SHA3-384 hash:	0f0483a67e1a7ad9e1dbe044df6eeb7e8e7e4f0e8612182c4e5dd82bb5cc7aeabff65c660e6acbb55457e639cf58003c
SHA1 hash:	7d68a030db751d8b22cf477c97e14398943930be
MD5 hash:	250efea88a677942b777f636e8fe6a37
humanhash:	enemy-sad-fifteen-rugby
File name:	AWB_131-39889640.iso
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	436'224 bytes
First seen:	2022-10-19 06:59:33 UTC
Last seen:	2022-10-19 07:17:04 UTC
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:Bifw/cnTY3Pi5CZ4grKP+DI2onBga8vKPPoX:Bifl0qrgrKP+DN0ga4
TLSH	T18394E048023A5671FF6FE23484AD82009EEBD069567D2E337F0DB8BCCB7795B91A4245
TrID	99.6% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter	cocaman
Tags:	iso SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: "Haotian shi <info@aerzenasia.com>" (likely spoofed)
Received: "from aerzenasia.com (unknown [95.211.204.216]) "
Date: "18 Oct 2022 15:36:57 -0700"
Subject: "RE: AWB_131-39889640"
Attachment: "AWB_131-39889640.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

203

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_fs2579.UNOFFICIAL

SecuriteInfo.com.Win64.Malware-gen.14603.25003.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

context-iso packed

Link:

https://www.filescan.io/uploads/634fa0767f72336a8d6295c6/reports/2ef0db8b-c9ac-4344-9ea2-7ffbe1689061/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6071b387b4dda9da63d4d4e8d6c43c1b156403902c56a77c78389b0f5597f65d/

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogger

Status:

Malicious

First seen:

2022-10-18 16:26:53 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mby3hb5u3wu5uy6u2tunnrb4dmkwia4qfrlko7dyhcnq6vmx6zoq._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger persistence stealer

Link:

https://tria.ge/reports/221019-hsn56afeen/

Behaviour

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Sets service image path in registry

Snake Keylogger

Snake Keylogger payload

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6071b387b4dda9da63d4d4e8d6c43c1b156403902c56a77c78389b0f5597f65d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research