MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5
SHA3-384 hash: 30d4faff95cb5cd22f1620cc12b5d2c2fbacae3412f5d72562d43ddb427098dd1d8e3f3d5bedca178edca3b30a77b052
SHA1 hash: 718c64817292ccf60e5087293b1c3fef01df802b
MD5 hash: fd729caac6bb713b2142079eda41f0c8
humanhash: king-quiet-lithium-jupiter
File name:PO 908534243.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:509'952 bytes
First seen:2023-09-20 14:52:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:Xf4NOk8oV/BR1z/8XIZwmlq/0efN0Ktl7ck1XSOiMulCnnJjH5y09Wh1amMwhTHp:qq/DfNWk1zduim0Y+wTHVKoN
Threatray 5'604 similar samples on MalwareBazaar
TLSH T192B4121836648E41E41A0BBD2C7104416772EA57F4A7E7395EC9B0D94FA3B7CC724A8F
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 886443434b83cbe2 (17 x AgentTesla, 7 x Formbook, 4 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO 908534243.exe
Verdict:
Malicious activity
Analysis date:
2023-09-20 14:54:31 UTC
Tags:
snake
Link:
https://app.any.run/tasks/3a9e808e-d9eb-495b-85e5-e09da99be731

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/450064/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2378.30458.19186.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650b075386207ed6281f8473/reports/9d1319be-b280-4b4d-b4ff-5468bde70f6b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/edb5e18c-75c5-4d94-a036-c66c485f6a4f
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1311648
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-20 02:54:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mj64g6smjbxl5xkt2ihroo4iiakpfjtcxobk7t6baxwncd7dv3kq._file
Verdict:
malicious
Similar samples:
52c6ffb87121554941e0039dc10e44aff96df0880d038bab6cc736d99814d0c2
SnakeKeylogger
68cd899c048a9b097d438260f9a92513b6cc42fc203c8126df2bb35b86c50671
SnakeKeylogger
9c999d23bb8110f85cc977e9a697c7eb3387dbe27ae0dba92c141986893946d3
SnakeKeylogger
9f064193ee006ae05b49119c2be37e4c9f8021d112041012ede0b8630d6f1a52
SnakeKeylogger
a33eafbcec3736e5d47d6c951a6824ed67a0e124131425f04e2e03864edf8502
SnakeKeylogger
d9eefd6741e692541008b7d71cde7d92662a6088247791f8a48e41b953324196
SnakeKeylogger
de3b0df29cca773ff488c9e27f051b767fa7bd93ae9fedd5db91037de48615ca
SnakeKeylogger
df8944cca7e607a5fe6765794fbd8c009de24cc170a99cd0cb7055b177b6a217
SnakeKeylogger
e61dc30af3bae04f163df687e66592073621fd84933988e36105405f38053c45
SnakeKeylogger
+ 5'594 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/230920-r9ahrsah99/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
32ba5e1afd61aad74fe36a9b16f0130a55ac16e6bcd5c5211b4d3514c87cdb1f
MD5 hash:
85ac5de10f13c0584d3e6117dd6cbb77
SHA1 hash:
ddc069e180fd7ae745065c6fe294ec2818469ffe
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/039bf342-d9ef-47ff-bdc2-e7754767ced1/
SH256 hash:
4c00f6d566b9f3d3f8407d44e477db87926c08fa089a351b165547de5a07d9d9
MD5 hash:
4fb1a7084bad3b1016533fee03610952
SHA1 hash:
d099e51ce5d9790bdc706a6f703294ad595cacb8
Link:
https://www.unpac.me/results/039bf342-d9ef-47ff-bdc2-e7754767ced1/
SH256 hash:
ef819e6b45ad8ddebd4b0b7f40658f67003cc5a6cca2009af39db84f2eb1890b
MD5 hash:
9191bb4ec7ee26547ef412f4ac7ebb2c
SHA1 hash:
a94a000432403327e627a0993f400c7377a35c30
Link:
https://www.unpac.me/results/039bf342-d9ef-47ff-bdc2-e7754767ced1/
SH256 hash:
7ec118e70613ce2d9aee29cda2918ca710dde346c68d4da75c2ea0402e6d4391
MD5 hash:
1622a62bf6805b2dca82a8632eceac71
SHA1 hash:
071b72a5a1231149dfe4b9fcfa3a6ee49265ab7c
Link:
https://www.unpac.me/results/039bf342-d9ef-47ff-bdc2-e7754767ced1/
SH256 hash:
627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5
MD5 hash:
fd729caac6bb713b2142079eda41f0c8
SHA1 hash:
718c64817292ccf60e5087293b1c3fef01df802b
Link:
https://www.unpac.me/results/039bf342-d9ef-47ff-bdc2-e7754767ced1/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/627dc37a4c48/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/450064/

Comments