MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
SHA3-384 hash: b3f1dbeee4cfa27f0cc57f59e4f337e8c77191bb4d08f2bff58cce5daf3bacb2cc3f8a858cd8bf05a563debc478cdee8
SHA1 hash: c2686af6102121ffc4c21926c1e372a4c317a11c
MD5 hash: af66a6b63432d99c58200b5b4d67d6db
humanhash: batman-asparagus-fourteen-east
File name:af66a6b63432d99c58200b5b4d67d6db
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:804'864 bytes
First seen:2022-10-12 03:56:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:Lp/tZsdtMyWIwf7fUALA4ZDhHFz2AbchffA3ZApUFqV:fZsdtDWbLUARZDhH5nYh3EmUF
Threatray 5'956 similar samples on MalwareBazaar
TLSH T1CA05387A11964607E8297135C8C7D2F32AFB9D607061D1C7AAD76F6FBC400BFA212386
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 0c4c4a4c4cb4b4b4 (26 x SnakeKeylogger, 9 x Formbook, 5 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/319146/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.LokiBot.RPS.MTB.23498.18562.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63463b0f84a686684c9a78e6/reports/f5a5cec5-59eb-47ad-894c-c37371eeeae1/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/355c84bb-be3e-41c4-b019-62381bcc7f30
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1088501
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-12 03:57:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncdjqexyujueifbur3gbmv47w5akrp6bpgkxmqpofq45w2wsohiq._file
Verdict:
malicious
Similar samples:
3db089afb5270b15e8e735de42546165885961bcdf9b3c547816c7b3ecc1b143
SnakeKeylogger
480e6eafca7220040b5c881ba63412843e888fb54e21b158a2568bec0cce0acf
SnakeKeylogger
66701f767a4daa10d667500feaa7aed5448ec49c2059a7bd4bea4b5b6f30cd22
SnakeKeylogger
6897412732ce8f38317aefff9c2bb19b15a91caccb0922c53fe29c36474de665
SnakeKeylogger
897c2f1baf4c1288b167efe0a25f658dc292e557d2e479a80171f24a41b07bdd
SnakeKeylogger
c1bff6750d2e97e236ec9af546da99de586e947375ca5b70f2004805786eb262
SnakeKeylogger
fa6901852ed9fd26b1adf6140ea9f8fe498edcf73f6b2350f825c10d71783a15
SnakeKeylogger
+ 5'946 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221012-ehxsrscdan/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/22f5e1d2-9422-4897-852c-777b98f69234
Unpacked files
SH256 hash:
161903f7d5633a0cdc5d416c229e1af16ad3f5a6d11dbe8d500aa9151a273f62
MD5 hash:
b460e7cd67e88a80f0b65f65d28b1c4c
SHA1 hash:
fef017687483cf2b5b9d5f8061b6f0645fdcf779
Link:
https://www.unpac.me/results/d1b261c6-0dbf-4277-b919-5c35f7743c75/
SH256 hash:
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
MD5 hash:
21246cfe0f90ff27085d76afa64244c2
SHA1 hash:
f76247ed2d0fdbd4496e3969cfcf6d457cc61fa1
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/d1b261c6-0dbf-4277-b919-5c35f7743c75/
Parent samples :
0a2309336014e8ef72f8e8bcb41902b3c7e56f5c8afa477fda99b1e4f57bb852
0f6df37b515f330df516df24a8023025514d88fea9371ff96491003dffdc9b09
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
f0579298f475e4a98ec491ff10dc3bbab6ceac3b4f376a297ae03d36c177a09d
521e9db681ade0e368a3e99d735333c0d18df6087aa1f2fe6984c84ce1e4a1d8
a3465cca56d61a376078e6ac2d7466fae46bf7d073b9145b768f77ff33a3da0d
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
2afad9ad588a3219b1b36b0096ff4a8db8d70082fd09a612dc6f5935e46f0d4b
73237e3aa90060dbd999b15b39d48db44b63a5d23fd9b2c279fc97cd43a862fe
4832ccbb9379c4046a7478c3cba20a47cb978f37f11ace9afe0d8adb73e17003
9187704232908ac59df2c41f8129eb02fd895817abbce1c6d961a8024ebeb092
6fd62542f92cfcd09af0b2ad8f007a9dc110d64c16cfaab24a9ffd6552a754e8
178f92100449f71a893b39f99b0b3b434d54bd2b2833aaefeb0ab4415f7fb713
df757778956e59dda13ed21877d89a7b55902f285c5958d248300e2e9cfffb83
552b11b82396419c3efd98ecb70657b2d7652d061bbd5d626e478812a65925ee
7b3466885a3f5a38211cd4b6991a384b4a9d8747d5498f4762183e2a48a7fd23
ed31c7e7fc9f786ba9afc2d2885da4db73c4cef7c4514ce69089f57732f5b1ae
68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f
c8b129ddf3b6fbe3a7fe51c48706375b0a3c90711fdbb0111e215076bbfeef58
78f1957ff80044cf3cee3e4efbedbb55f3b64814ed8804fd076822d4ffcbcb6a
17c4cd880779f7dc3b48f6a2e097770b8b078fcc25f06286874233b3fbcb5099
3c78d5139a49e3f81272c1c7e7eae14f22ed3f7e89b8675663a574153d803eef
875ec0c37d9c973142c00da42bb1b6b6e58115cf85ba0e4e231d7bed7df3b21e
fc994ac728ca7b5d34d00f167b331c187110c45d4911572adc1eb279eb158b00
6381387fc80de027985e11c349120a3ee36724617ccbd2fb67b2d72663f8f93e
18743d67309b9042dccd7fc9b27dfdf6860b11745831d891fb64142836e3fc77
1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
585d258b90d3d045c1bd5e5858cc174a51bb25a425612934cd7f167e9a5029af
45ee7fd677dda19356451ef24de0d55b3ccdb5b54c47b5b053a1cf7a280736dc
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd
5bbeb09102c0876fc3d18a31c5aefdfc6f42a4354422611bfefedba2d51da208
cb252bdd63776400aa0f5b41de8ea075a2acb0ef25bcbcc430adb2d356b9e751
489ceb676e0e15e5e5c277ccb679b4508c7ac746e36ec21d4c7d9a52f8f1c88b
SH256 hash:
af7ac1171b44c9a949ad80bfaf05095048d0b74cfb527f66479e22f47d340110
MD5 hash:
f696dc0e00cb8f70799ac3fcaa5f9f6a
SHA1 hash:
cde2283de5b89639ea52f6388feef8f77efc63ce
Link:
https://www.unpac.me/results/d1b261c6-0dbf-4277-b919-5c35f7743c75/
SH256 hash:
3ab6b25e7d97b15e3838f49855aee1df002d4e9ee2fdb89b331b5b12567a2301
MD5 hash:
f83477139daa0150b68facbd7a073716
SHA1 hash:
8cae9385c82c0ec6f73a6dbb6d1ec7c46f3f2e14
Link:
https://www.unpac.me/results/d1b261c6-0dbf-4277-b919-5c35f7743c75/
SH256 hash:
a5b55146071e0e3776e8e5769a0cf5d7d9c2a143af3c6aba51e22101cf042333
MD5 hash:
5023b452b933b020ef85d10460854840
SHA1 hash:
8c6314d2e7199e08bc45e7f803dbd49dc51ce172
Link:
https://www.unpac.me/results/d1b261c6-0dbf-4277-b919-5c35f7743c75/
SH256 hash:
68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
MD5 hash:
af66a6b63432d99c58200b5b4d67d6db
SHA1 hash:
c2686af6102121ffc4c21926c1e372a4c317a11c
Link:
https://www.unpac.me/results/d1b261c6-0dbf-4277-b919-5c35f7743c75/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/68869812f8a2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2355050/
  
URLhaus
https://urlhaus.abuse.ch/url/2355014/
  
URLhaus
https://urlhaus.abuse.ch/url/2355048/
  
URLhaus
https://urlhaus.abuse.ch/url/2355039/
  
URLhaus
https://urlhaus.abuse.ch/url/2365758/
Cape
Cape
https://www.capesandbox.com/analysis/319146/

Comments


Avatar
zbet commented on 2022-10-12 03:56:18 UTC

url : hxxp://104.168.45.124/00/luck.exe