MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc
SHA3-384 hash: 3ff4a328c896500fa461c1e573d46d955ab58df6d6bf5ae381c3b23226e8d04ccbf982e2591ac14d5170060469a4a38c
SHA1 hash: c86e003f80dcc3fa13604e246352152d5d0f89dc
MD5 hash: 0772fd245d4cc724886f54fa49bf574e
humanhash: mountain-three-massachusetts-thirteen
File name:CaixaBank _ banca digital CaixaBankNow.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:622'592 bytes
First seen:2023-05-19 06:17:24 UTC
Last seen:2023-05-20 14:54:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:vYbgECYnuw6YuMO0i7SSW8rEeQWpR1989:vwBpuw6YuNmSrrEBw9
Threatray 5'464 similar samples on MalwareBazaar
TLSH T156D4E0202BD9C70BD06B437881E5C3F057369D84B966C7974FE9BC4FB2CB6A61321256
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f8eae6e6e6e6e46a (13 x AgentTesla, 10 x Loki, 7 x Formbook)
Reporter abuse_ch
Tags:CaixaBank ESP exe geo SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
262
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CaixaBank _ banca digital CaixaBankNow.exe
Verdict:
Malicious activity
Analysis date:
2023-05-19 06:25:32 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/5c033e94-fd06-4c67-a135-2a0ef8778988

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Generic.33752126.15111.13428.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook packed remcos
Link:
https://www.filescan.io/uploads/6467149c7dab2ebd47d2059b/reports/c7addc58-e026-4785-a9de-66cfcdda8f32/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/44836ab7-3f83-47a3-8760-313b83d622ed
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1236857
Signature
.NET source code contains potential unpacker
Found malware configuration
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Moves itself to temp directory
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-18 04:48:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mx56jmz37xjesecxgohlip3z26fqsqwh3gwfniuanv4qfj6i5pga._file
Verdict:
malicious
Similar samples:
0368b2ffa6991460a59b03edcd2ef71c423a27d4902b2222248bc0935776614d
SnakeKeylogger
3836e97722f2267266161a857140dfda9731e6bcec5147169c86410a39ac24e7
SnakeKeylogger
6d79b5cb1aa503cef77ef725f7cb1980e312be3271b4e0fde0bf012c6c54becb
SnakeKeylogger
8ad9b102b105787a966e03694a5db89886b5ffcf97e8de4ef340f76b5e9e7e4f
SnakeKeylogger
ad06dd86354aa9e61e6de1aabf9efa7539fb13edb2e23e1eb63b86d59203e55f
SnakeKeylogger
cdd93cdf75bd61ac9b31635647f23d4e7c58aa1d6c82568b3f8036b6f44aa222
SnakeKeylogger
d89787191bcbb0685fe37fb26409367f1b00a23e4f578081785f7dba7aa2a9ce
SnakeKeylogger
db1514e42b561d3851aa327b612b8075d4b9387eb054dff98a7b1fe026238e35
SnakeKeylogger
e3e6d851f1598eb145492e46d7431f72436178f1a60ebc4d6742839e12d52200
SnakeKeylogger
e8f271e2c00c7310ba76f5be24f425df7b4c3fdd84a0b715906a10da4f7e879b
SnakeKeylogger
+ 5'454 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230519-g2lwqafd87/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
2907ceb0aff33154a49177d6e04e822538f3fb439a55264cdf84b162564afea6
MD5 hash:
ae06e9b9c5d6df3bdb39fbbc75d9b9cd
SHA1 hash:
b03aff7dda4462819b1250e44d80c83aca37237f
Link:
https://www.unpac.me/results/3b3aa439-3455-4421-82ec-4955c7218c56/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/3b3aa439-3455-4421-82ec-4955c7218c56/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
af7a2d9e3f3e313fd69f435428863a5ce7fe4756bde8f3e715d20721ae484c51
MD5 hash:
828456b4257a7a6d7532089382e200b2
SHA1 hash:
8913537ef741d56c6559933c695f8c2693472f84
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/3b3aa439-3455-4421-82ec-4955c7218c56/
Parent samples :
db1514e42b561d3851aa327b612b8075d4b9387eb054dff98a7b1fe026238e35
65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc
d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5
978a959c5131f0e37d076b6a2b777c35cae4f58756a3d25be2662e58301f0ebd
c4fce336f2e0a78838016ce095556c8d121801cc13547438f1b3464afab94b49
389cd12974a382686c0f491549b4bbe32c2dc9604b0b3a193ee4fb30ede8335d
SH256 hash:
546b72354bbc0907de4fe9d7356675306026419585db4af6bc81f3cb83274d5f
MD5 hash:
9187bd5ed7eac58e8c5f37b98bf5c2a0
SHA1 hash:
562b8d63e0d1aaf75a9bb38c248139dddbc0c1da
Link:
https://www.unpac.me/results/3b3aa439-3455-4421-82ec-4955c7218c56/
SH256 hash:
7c458d3fc90cd2e10a4e8ac6c8909f71428fb60a67c2678cde5d1cd802c7070b
MD5 hash:
434c74dc5aec91bdc55ed847671daed7
SHA1 hash:
1196ad3ef1509c14957fda40da84260401a34af8
Link:
https://www.unpac.me/results/3b3aa439-3455-4421-82ec-4955c7218c56/
SH256 hash:
65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc
MD5 hash:
0772fd245d4cc724886f54fa49bf574e
SHA1 hash:
c86e003f80dcc3fa13604e246352152d5d0f89dc
Link:
https://www.unpac.me/results/3b3aa439-3455-4421-82ec-4955c7218c56/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/65fbe4b33bfd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments