MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 640317fbdeabebaec309917e29d48dd89725afd6cb0943b6a1a0d192767c63c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 640317fbdeabebaec309917e29d48dd89725afd6cb0943b6a1a0d192767c63c5
SHA3-384 hash: f596c0a97d2386acec8aae82f3e85de6f2ec9138781ef102c08c300661782d86c231a471d5f99b1de5a8e28adfe32580
SHA1 hash: 3fb049f3518231510c4543e70c44b3f8267a44de
MD5 hash: b555ec21f7a394d02f4151900d2d2986
humanhash: robin-mississippi-yankee-video
File name:ING BANK_RO0198453.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'262'592 bytes
First seen:2021-02-10 07:26:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:9LfJ5joXK2LUxv7VNdr1GI1xc8afVBn3pMKRT5c72qlLmCdsO+ox6cl:9zJ57xpLpLc8w/dT9k+or
Threatray 213 similar samples on MalwareBazaar
TLSH 4D45BE526116E6D4D83D963A048B80C443F46B3A7470CF9BA9C8116738EFEC5AF4EDE6
Reporter abuse_ch
Tags:exe geo ING ROU SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: centoswp.internew.gr
Sending IP: 185.78.221.121
From: ING Bank <noreply_payment.confirmation@ing.ro>
Reply-To: result.box2019@mail.com
Subject: Tranzacție_ finalizată prin ING Bank_RO0198456
Attachment: ING BANK_RO0198453_PDF.rar (contains "ING BANK_RO0198453.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ING BANK_RO0198453.exe
Verdict:
Malicious activity
Analysis date:
2021-02-10 07:31:25 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/e87aab14-369c-4ded-92ff-750c18137f8e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116390/
Detection(s):
Win.Trojan.Autoit-7356348-0
Create hunting rule

Win.Dropper.Bifrost-9830123-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Running batch commands
Launching a process
Sending a UDP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Sending an HTTP GET request
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/604293
Signature
.NET source code contains potential unpacker
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 351177 Sample: ING BANK_RO0198453.exe Startdate: 10/02/2021 Architecture: WINDOWS Score: 100 48 Multi AV Scanner detection for dropped file 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected Snake Keylogger 2->52 54 4 other signatures 2->54 7 ING Bank.exe 14 2 2->7         started        10 ING BANK_RO0198453.exe 15 6 2->10         started        14 ING Bank.exe 2->14         started        process3 dnsIp4 56 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->56 58 Injects a PE file into a foreign processes 7->58 16 ING Bank.exe 2 7->16         started        40 192.168.2.1 unknown unknown 10->40 28 C:\Users\user\AppData\Roaming\ING Bank.exe, PE32 10->28 dropped 30 C:\Users\...\ING Bank.exe:Zone.Identifier, ASCII 10->30 dropped 32 C:\Users\user\...\ING BANK_RO0198453.exe.log, ASCII 10->32 dropped 20 cmd.exe 1 10->20         started        22 ING Bank.exe 3 10->22         started        file5 signatures6 process7 dnsIp8 34 checkip.dyndns.org 16->34 36 checkip.dyndns.com 216.146.43.70, 49753, 49754, 80 DYNDNSUS United States 16->36 38 freegeoip.app 172.67.188.154, 443, 49756 CLOUDFLARENETUS United States 16->38 42 Tries to steal Mail credentials (via file access) 16->42 44 Tries to harvest and steal ftp login credentials 16->44 46 Tries to harvest and steal browser information (history, passwords, etc) 16->46 24 conhost.exe 20->24         started        26 reg.exe 1 1 20->26         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/640317fbdeabebaec309917e29d48dd89725afd6cb0943b6a1a0d192767c63c5/
Threat name:
ByteCode-MSIL.Trojan.OutBreak
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 04:51:49 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mqbrp666vpv25qyjsf7ctven3clsll6wzmeuhnvbudize5t4mpcq._file
Verdict:
unknown
Similar samples:
1f6b100b68c412b9a6c4289ce2e387bc13805bc9cc46141c3bf2bf497cff3649
SnakeKeylogger
2fe26662d53b976914fd7bd9fbb589f5bd4114f47753c9437593b29fcd04c236
SnakeKeylogger
564d8ca154a08dbbe3af33d3ec5b5345c31fa8a56d536f9b22063c99db8455d7
SnakeKeylogger
854943461f0cbcc761f4329a919a99ba3143b2fda953e15b9c87207eb7fe9a2d
SnakeKeylogger
911f22d0fdceeec6e8e6426b0111c1632e6b70f21940584aa05345ac470c4c4f
SnakeKeylogger
a64e5937498672b5ecc6f610f6309e8508aab9db74766a2a88155bbd1dc3d869
SnakeKeylogger
ac49b13a29865922dc70c90a504fd3d7de7c6c64396238d65a9d0cedf33b4065
SnakeKeylogger
cc15e8a9e04355389815d8a7be4c34746c87a2a9d672e426c01b00ad0a583069
SnakeKeylogger
dcee48e2f46c8b69a3a5b2b1cae7fb3d26916d3189dc8977fef7aeda3a2ba850
SnakeKeylogger
f535414d7bdcacff5db6ba209be888ebcd7996b1602a3b78a574b72d03cca147
SnakeKeylogger
+ 203 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger persistence ransomware spyware stealer
Link:
https://tria.ge/reports/210210-1nnxj9ve3e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
640317fbdeabebaec309917e29d48dd89725afd6cb0943b6a1a0d192767c63c5
MD5 hash:
b555ec21f7a394d02f4151900d2d2986
SHA1 hash:
3fb049f3518231510c4543e70c44b3f8267a44de
Link:
https://www.unpac.me/results/369c7d92-f009-47c9-8824-bc442dac7d50/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/640317fbdeabebaec309917e29d48dd89725afd6cb0943b6a1a0d192767c63c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 03b5f9740ffbcbfb6f889210e96b578868034d8355ce1fd4e84e93ad1f757d3b

SnakeKeylogger

Executable exe 640317fbdeabebaec309917e29d48dd89725afd6cb0943b6a1a0d192767c63c5

(this sample)

  
Dropped by
MD5 eca602e48415f0a63555b09ea584981e
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/116390/
  
Dropped by
SHA256 03b5f9740ffbcbfb6f889210e96b578868034d8355ce1fd4e84e93ad1f757d3b

Comments