MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dba1d64c9cb55a4a75a7db60f0a1eed15db12e598985112cf49e8d61c477abe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dba1d64c9cb55a4a75a7db60f0a1eed15db12e598985112cf49e8d61c477abe
SHA3-384 hash: 44d882a262051dba112fae66f9945756e8bfacd8dbcc607d3d313e631303e8f88a8d533a92009fc382b23ff72a1a249e
SHA1 hash: 0d292558063d224a4d2eea476791a319a5583e3b
MD5 hash: fe1b787fd53fa5d311a3e9407ac0a461
humanhash: high-saturn-lion-coffee
File name:HesapEkstresi.bin
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:936'960 bytes
First seen:2022-07-11 12:23:39 UTC
Last seen:2022-07-11 12:55:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:wR05WSuGZz0vNQAIeAWqGqrieb64EHuc2jBpNUPZAOxArtvygo2Ys:AQcAYv5AkCG4EHu/jBYPanrtygrYs
Threatray 4'201 similar samples on MalwareBazaar
TLSH T10E15D0CBA011DA50F125357C31BEE3905172AC7A899CFECFB86D7C3D09F49A6241A6C6
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 31b094969698b033 (3 x SnakeKeylogger)
Reporter KdssSupport
Tags:exe SnakeKeylogger


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
3
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
HesapEkstresi.exe
Verdict:
Malicious activity
Analysis date:
2022-07-11 11:25:59 UTC
Tags:
trojan evasion
Link:
https://app.any.run/tasks/06a9e6a4-e888-4156-adab-1b608a6d988e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/286227/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.26528.17556.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62cc16a5a496df53c2518a40/reports/40bd87d1-4910-4af7-b8ab-2201f72d8a4a/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/73a9a417-279f-495c-9959-2bdeee198628
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1028902
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 661392 Sample: HesapEkstresi.bin Startdate: 11/07/2022 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for dropped file 2->41 43 10 other signatures 2->43 7 HesapEkstresi.exe 7 2->7         started        process3 file4 23 C:\Users\user\AppData\Roaming\aZjpYmL.exe, PE32 7->23 dropped 25 C:\Users\user\...\aZjpYmL.exe:Zone.Identifier, ASCII 7->25 dropped 27 C:\Users\user\AppData\Local\...\tmpD20A.tmp, XML 7->27 dropped 29 C:\Users\user\...\HesapEkstresi.exe.log, ASCII 7->29 dropped 45 May check the online IP address of the machine 7->45 47 Uses schtasks.exe or at.exe to add and modify task schedules 7->47 49 Adds a directory exclusion to Windows Defender 7->49 51 Injects a PE file into a foreign processes 7->51 11 HesapEkstresi.exe 15 2 7->11         started        15 powershell.exe 25 7->15         started        17 schtasks.exe 1 7->17         started        signatures5 process6 dnsIp7 31 checkip.dyndns.com 193.122.6.168, 49766, 80 ORACLE-BMC-31898US United States 11->31 33 checkip.dyndns.org 11->33 35 192.168.2.1 unknown unknown 11->35 53 Tries to steal Mail credentials (via file / registry access) 11->53 55 Tries to harvest and steal ftp login credentials 11->55 57 Tries to harvest and steal browser information (history, passwords, etc) 11->57 19 conhost.exe 15->19         started        21 conhost.exe 17->21         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6dba1d64c9cb55a4a75a7db60f0a1eed15db12e598985112cf49e8d61c477abe/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 11:16:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nw5b2zgjznk2jj22pw3a6cq65uk5wexftcmfcewpjhunmhchpk7a._file
Verdict:
malicious
Similar samples:
1877648fdaaeb4d9cc21527eb8c3d5609b41333d886f73837a4fd3a2116d9973
SnakeKeylogger
2819d01cca3a58daf8f09c9eecde4fa1baaad5efc0df728cafd1fa852e37afc1
SnakeKeylogger
43e94df274c3b9b46fd384ad2c5943bdd5d209bce84414e6a7e42383922dec67
SnakeKeylogger
63f1b10c759ba99da98645bdc82e508012b7a6602945c991e42285d1e2ce7bf9
SnakeKeylogger
8399cf97a24ffed931ae3b24203ff6af69027c5d5651a31b11ccd51840b1a113
SnakeKeylogger
85dbaf3c1ef1403904104404461f1a40b9a0382c30babdc8db98c5dd38d1c7f7
SnakeKeylogger
86eefb61308feb54cd1933852bef9e6f42f000c0cfab9640673ad924c3b38c6f
SnakeKeylogger
a59fd17f9d10de072c5ebef7f57a040d0f2dfd5d66c0640020be80f204d48588
SnakeKeylogger
c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825
SnakeKeylogger
dbdf95efcfba65bef51e2ffaaaf83c908158eacc1e42967841d68ad2ab6bbf26
SnakeKeylogger
+ 4'191 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220711-pk183shabq/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5583198829:AAHbRGAnlJ9Tg3ETPxGtj_jZ8tVhm4DB4io/sendMessage?chat_id=1148000519
Unpacked files
SH256 hash:
46a3d332efd5a03e259f21d278465cc953e419d4e95c15074cc7bd6ba041e909
MD5 hash:
a8590b50285a1d9b53acc65218040377
SHA1 hash:
f42bac167fb02b2b2e9c43b2f1cf724b1191caa2
Link:
https://www.unpac.me/results/6efed896-f756-4b67-accb-db7b6acbb66f/
SH256 hash:
0fae1855c65d635d55e5f6aa450d8c9f3bd63c5cb4ef8e7d6947757b6c4a812e
MD5 hash:
51b3e4f94acfd5f6febdeda4f4e09db3
SHA1 hash:
c526c72601e747287c80aebb4357e6091aa2a960
Link:
https://www.unpac.me/results/6efed896-f756-4b67-accb-db7b6acbb66f/
SH256 hash:
883b63ef84c6b1cc09687962beca56e4f4b7960df7c5459e29998befaa3ccf15
MD5 hash:
ecb3f27eb8279c51608c8ea8f8050655
SHA1 hash:
82385d75444ab5fccacf37e2746c7dce73faa7f3
Link:
https://www.unpac.me/results/6efed896-f756-4b67-accb-db7b6acbb66f/
SH256 hash:
9de69bdd56795088fcfe094e8a61ffc7b8172e3180dfe76a117ac29c24483499
MD5 hash:
d52423b217c92ff3afbbd81388d7014f
SHA1 hash:
d7a6f464e560c3839116f515c50fc5e8d17a414a
Link:
https://www.unpac.me/results/6efed896-f756-4b67-accb-db7b6acbb66f/
SH256 hash:
d804888b755c1e40605b9c8ff9b684cfb3ce385d4b63ccefbb716aa01c0870f4
MD5 hash:
cc55875b94fa297835b736f0946e9f02
SHA1 hash:
bd319700d7b51b78f5d066818845155e12948dbf
Link:
https://www.unpac.me/results/6efed896-f756-4b67-accb-db7b6acbb66f/
SH256 hash:
6c1a322729976abe64cd786dab4f8a2eed6aa2672822fdd05611974a3426deb7
MD5 hash:
5bf785b08c42743aa705056fbbee9e24
SHA1 hash:
83ab0c8a936bd8bd666aabfebebddd19ffc6f059
Link:
https://www.unpac.me/results/6efed896-f756-4b67-accb-db7b6acbb66f/
SH256 hash:
6dba1d64c9cb55a4a75a7db60f0a1eed15db12e598985112cf49e8d61c477abe
MD5 hash:
fe1b787fd53fa5d311a3e9407ac0a461
SHA1 hash:
0d292558063d224a4d2eea476791a319a5583e3b
Link:
https://www.unpac.me/results/6efed896-f756-4b67-accb-db7b6acbb66f/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6dba1d64c9cb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6dba1d64c9cb55a4a75a7db60f0a1eed15db12e598985112cf49e8d61c477abe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 6dba1d64c9cb55a4a75a7db60f0a1eed15db12e598985112cf49e8d61c477abe

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/286227/

Comments