MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ea22015e82914ca041d38d57529e7effb1ed368e73fafa7699ec8ffffbef5eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ea22015e82914ca041d38d57529e7effb1ed368e73fafa7699ec8ffffbef5eb
SHA3-384 hash: a693ea68c91fc01c2b8a076164e41f7023b733226ef0ac395e86769c938878688fd0ef608050aa94cf2005051b8bb76a
SHA1 hash: 581bd35fec598962a66a238345b864923f3b5b5d
MD5 hash: 522f2b3febaf7eef257c7750ce915da5
humanhash: undress-nuts-missouri-november
File name:DHL Awb_ Docs 5544834610_pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:6'144 bytes
First seen:2021-09-23 12:45:45 UTC
Last seen:2021-09-23 14:14:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 96:uImvwQ+n6PrvNhbhlg5lioEjGb1ZYjzNt:TmvNh1lSMm0l
Threatray 1'225 similar samples on MalwareBazaar
TLSH T1E4C1C712A3E88727E0B647389AF74701B778ED564E57CB0D78D0520EAD27710D962BB4
Reporter abuse_ch
Tags:DHL exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL Awb_ Docs 5544834610_pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-09-23 12:46:39 UTC
Tags:
trojan snakekeylogger keylogger evasion
Link:
https://app.any.run/tasks/8bf4f367-c992-4008-a153-97ccf34d4d13

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190748/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Stealer.ic.16830.8883.UNOFFICIAL
Create hunting rule

Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b5273b8-8cda-4ac2-bf47-c04e1d69eb9c
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/856741
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ea22015e82914ca041d38d57529e7effb1ed368e73fafa7699ec8ffffbef5eb/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-09-23 11:45:58 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2rcafpifekmuba5hdkxkkph575r5u3i44727j3jt3ep77566xvq._file
Verdict:
malicious
Similar samples:
0741c36ad10f51f858eefc2e2f0879c9ef1ae90af61d766bd50ebcc67f4d5579
SnakeKeylogger
0b365ef77b8b8ed330a2e48b081a20d9eb5b275b276306e5b51615cf10821fe0
SnakeKeylogger
16dd2fa5ef070435058d08afeb54457be857cf4e675679c2ff7476e19d85782a
SnakeKeylogger
2f191f3f801c618672edcd5f2b3761b2137cdd76af6db7e39ff41102e1b9cde7
SnakeKeylogger
4bf0a4f0f3a5ec360025a47b486bd5e3c779f56b7915fef0efcc8754a342ba7d
SnakeKeylogger
51e6527daa5a10028c434c7ceaed1570ddd95e1de0eafa702f77860cec3d0b7c
SnakeKeylogger
66fa12f36a4474e6abef1c5a0dbd899b7cacca24e89077f150f1771aa3df94c7
SnakeKeylogger
a0ab3ba06ede4ced5c9ea2a9d87c49063249d1480c72b56ba4371b69b92c6fee
SnakeKeylogger
f44394f10dd10600a8f25093e76fac442c594ea85debf6bfea0933766529f747
SnakeKeylogger
ffec1862f56857ad722abbcb98be7af86f2cf0763371bcb40273f0d884157c32
SnakeKeylogger
+ 1'215 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210923-pznarsecep/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Downloads MZ/PE file
Snake Keylogger
Unpacked files
SH256 hash:
6ea22015e82914ca041d38d57529e7effb1ed368e73fafa7699ec8ffffbef5eb
MD5 hash:
522f2b3febaf7eef257c7750ce915da5
SHA1 hash:
581bd35fec598962a66a238345b864923f3b5b5d
Link:
https://www.unpac.me/results/169e47b3-a7a2-4373-bf48-1c9aa8d05737/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6ea22015e82914ca041d38d57529e7effb1ed368e73fafa7699ec8ffffbef5eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 6ea22015e82914ca041d38d57529e7effb1ed368e73fafa7699ec8ffffbef5eb

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/190748/

Comments