MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6909f3a01da363efcaf05aa899b1223818923972ba34b90ae6ef8fd062d0cd4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6909f3a01da363efcaf05aa899b1223818923972ba34b90ae6ef8fd062d0cd4e
SHA3-384 hash: 3f9ff4d6b3386bfef8c48ea0c2d58aaa254b31b0d9f357f46d5c260871e198db0c1b3094aeaf1c0ac650da2a30bc3425
SHA1 hash: b14b7d84c3bd12b1793d9d32fc514fc1eb3ca212
MD5 hash: 168ce18dbf3d77be7743b4d82968c391
humanhash: alabama-wyoming-yankee-island
File name:1sFcfmbXgjjBHN3.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:975'360 bytes
First seen:2022-10-10 14:13:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:jqOIljd2iNQvsM6ihZytuVrSLxBWfREoyBIGC29uVfZH:rIljd1IZguSLWfRXOXCu
Threatray 3'571 similar samples on MalwareBazaar
TLSH T1432538BA21868807D4247536C487D5B32BFBAD516162D2CB2AD73F1FBC412BF951338A
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 69e8bce9f0f87939 (16 x SnakeKeylogger, 1 x AgentTesla, 1 x Loki)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/318474/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/634428b3979fe5ad3328ae37/reports/564f9e61-cc45-49c1-ad11-b655a1098139/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4dd426ad-705e-4fe9-8fa3-578b3c65d663
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1087179
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6909f3a01da363efcaf05aa899b1223818923972ba34b90ae6ef8fd062d0cd4e/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-10-10 14:14:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
34
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nee7hia5unr67sxqlkujtmjchamjeolsxi2lscxg56h5aywqzvha._file
Verdict:
malicious
Similar samples:
21d5bf04d0ee52a9cb9e4f92494a719b03753cdf4958a595604436766ab4142d
SnakeKeylogger
406617d0e63986d0ec68a43c63ef706269e8d80bc2c51245ba7826ebb3477122
SnakeKeylogger
6fd62542f92cfcd09af0b2ad8f007a9dc110d64c16cfaab24a9ffd6552a754e8
SnakeKeylogger
7f2facd4792ee73be46594902ab0c79ecc7b79b462e403596b88e27b0bbba5d5
SnakeKeylogger
8fc6ce85bbf1ffe09f896024dbc3ab65c3d8eb13403b67c50c448b0a688e84f2
SnakeKeylogger
a5cccf181c07d537bc3ca811ac2b4bce8fff5bf0a72bc6b35246d0ca2e420b14
SnakeKeylogger
facc30986e6911b55eb20371486997475a4f19df35919dbea2f41e11543e0511
SnakeKeylogger
+ 3'561 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/221010-rjz1qsccep/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5542941782:AAFlsn_FCfYT7D_ZthXK_Udd4a15AE58_Wg/sendMessage?chat_id=2054148913
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a04e5df8-b856-42c1-9e3a-c5dbebb2bfa5
Unpacked files
SH256 hash:
c9aca067a4fcd88f299b7d3dec25b00aaf5c9527db5f56fd40e074c7f3077131
MD5 hash:
3e3fe2390517612578dd4a50181dc76a
SHA1 hash:
e2319a88be262495802b15e6fb35c98aa358b03b
Link:
https://www.unpac.me/results/386f00ca-9197-4c75-9639-ae1e04a3138b/
SH256 hash:
ee19517fd406b0187d16f9db162005162fa0248b8895968c9aee9e80e586e6f5
MD5 hash:
2e5804615fa2163ff3d8441a4c94b6ee
SHA1 hash:
c30ab3801d4d7f761ce212e8f59fe133021302e4
Link:
https://www.unpac.me/results/386f00ca-9197-4c75-9639-ae1e04a3138b/
SH256 hash:
70dfa4c873605ab0fcdcb62be2a970da110535280d8dc88261edbe1ed2865307
MD5 hash:
d5b0f8aff064b3e828421b48efccd312
SHA1 hash:
724f4bc7ab4e08c45562748b739c8f7496a5ad8f
Link:
https://www.unpac.me/results/386f00ca-9197-4c75-9639-ae1e04a3138b/
SH256 hash:
badf4994b0c994b2894ffa59e53475e76aeb98e32310b3e4733ec952117ddcdc
MD5 hash:
41738b1f4b60af050cc7bce2c11670c0
SHA1 hash:
35846789ca0194b4fa16217cbddc13a043a318f3
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/386f00ca-9197-4c75-9639-ae1e04a3138b/
Parent samples :
6909f3a01da363efcaf05aa899b1223818923972ba34b90ae6ef8fd062d0cd4e
0296e49137a482b7db3bed7fe16c5ad20b083b20a8ce56b6c42309fff94d50b6
605995d682d1e7f038aa33ab39ba0a6e8330aa8f13836c0d21cec48a4a56e46d
b3905eeb2235f6893aadc3bdc789cba0860dcd240d7149371c5fa03c809e4b59
b1a095ae8f5562162a591f8871ba8aecc46d43e875a19f2cd56d7b9c03b56cb2
4ade79259ddc557d6b0abf68de4b5fbe61e532db6eae5b29ef30e3a71bbf17e2
d65163defaea092a6be7661cdde670e18e54ae79790ffa5f64385daa5ceccabe
SH256 hash:
1383999cb3682a0a0a54fad8a8e3f0fda2d4ce6422fa35286cece258aa1844a1
MD5 hash:
d891ee2f90e3392ee593067a038f3335
SHA1 hash:
347e96ac60f38938b0061ce5c21bec28c87f71f9
Link:
https://www.unpac.me/results/386f00ca-9197-4c75-9639-ae1e04a3138b/
SH256 hash:
6909f3a01da363efcaf05aa899b1223818923972ba34b90ae6ef8fd062d0cd4e
MD5 hash:
168ce18dbf3d77be7743b4d82968c391
SHA1 hash:
b14b7d84c3bd12b1793d9d32fc514fc1eb3ca212
Link:
https://www.unpac.me/results/386f00ca-9197-4c75-9639-ae1e04a3138b/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6909f3a01da3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6909f3a01da363efcaf05aa899b1223818923972ba34b90ae6ef8fd062d0cd4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318474/

Comments