MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ee61893309dd1379d78ad9b04f5c3c5a5b733af82bf64c3dfe28ff6f6d147be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ee61893309dd1379d78ad9b04f5c3c5a5b733af82bf64c3dfe28ff6f6d147be
SHA3-384 hash: 63fd60642b97fbe24e6e72ef9c96959cb338d22647fabf28757b6f452eff5e262880c24727b26af6fe816866954cd109
SHA1 hash: e6fa73c0a27f93d457889d648290dc45238a34aa
MD5 hash: b58b012bee2e4a488994e8a01d754dd6
humanhash: fix-ceiling-berlin-nevada
File name:Purchase order.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'048'064 bytes
First seen:2021-02-16 14:16:29 UTC
Last seen:2021-02-16 15:38:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:65QA4YI6Z7iYtU+wkxz5L3qOHWRLDZYdg4zmj:HM9Z7iYtdL6O2R/ZYdgkmj
Threatray 261 similar samples on MalwareBazaar
TLSH 4025CF3267086B5DF039F33D402A191CABF5F84AE331DE5E7EDE86CA0429E059765623
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: mail.etheshi.ml
Sending IP: 128.199.121.10
From: B.Vetrivel <rfq@etheshi.ml>
Subject: Purchase Order From Samyak Ltd
Attachment: Purchase order.tar (contains "Purchase order.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117340/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.543.5041.23278.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/609005
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ee61893309dd1379d78ad9b04f5c3c5a5b733af82bf64c3dfe28ff6f6d147be/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 09:47:00 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3tbrezqtxitphlyvwnqj5odyws3om5pqk7wjq674kh7n5wri67a._file
Verdict:
suspicious
Similar samples:
1dc2a4dd6e7e1525ff0e92f87bf12b95f62eb5750bdec7a41d40e49a3b2f9d81
SnakeKeylogger
493e65a8a6f906e7111363355a5616ee049e00882b21969542f68e0421b273e0
SnakeKeylogger
4e206dcf64691be28bb9194c7975c4fa84a10ce8565d518939dfd7b95103b0d0
SnakeKeylogger
551f62709e81c5aae58beb29ab56cc7fc139516ffa19b9366969d0fac1fad88b
SnakeKeylogger
7ffcfe208773bc49ef7a0e832fe117592b8eaf83484ebc9cfe9c64eb354aadec
SnakeKeylogger
b246071c05dec2f4838b27fd6c11548e90f7deaaeb658530864d10efdb129c37
SnakeKeylogger
ba37e565326e38c8d7ce5a02d385ff8ae55a66ef81edac15a72f59a92e7ff090
SnakeKeylogger
c74375870b8ed3789f5dda4a617b310fe4a8d2d073f8337cb67362eaf324be2c
SnakeKeylogger
e5ea618e1c51b6f724e1527d81465fb53693449199b768bacc62d0caca5c1fbc
SnakeKeylogger
e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9
SnakeKeylogger
+ 251 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210216-m33g66y9nj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
b2499a2af35b550fbe7f541a14ff1225e1202324f351eecf85de6c8e9fc7c27c
MD5 hash:
5e732e4265622675313195dead01047e
SHA1 hash:
359c710a93c2f58cdc2a45de8dd48a6884a70645
Link:
https://www.unpac.me/results/a08ddca2-a700-4d86-8c26-2a4a9454af7e/
SH256 hash:
6ee61893309dd1379d78ad9b04f5c3c5a5b733af82bf64c3dfe28ff6f6d147be
MD5 hash:
b58b012bee2e4a488994e8a01d754dd6
SHA1 hash:
e6fa73c0a27f93d457889d648290dc45238a34aa
Link:
https://www.unpac.me/results/a08ddca2-a700-4d86-8c26-2a4a9454af7e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/6ee61893309dd1379d78ad9b04f5c3c5a5b733af82bf64c3dfe28ff6f6d147be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

tar e2eb06b75e10c47d3e01a095a27a6866b0b76b2658ec0f799b4bd83d21467b52

SnakeKeylogger

Executable exe 6ee61893309dd1379d78ad9b04f5c3c5a5b733af82bf64c3dfe28ff6f6d147be

(this sample)

  
Dropped by
MD5 3450d46170adac04e7ff0d8fd247c214
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/117340/
  
Dropped by
SHA256 e2eb06b75e10c47d3e01a095a27a6866b0b76b2658ec0f799b4bd83d21467b52

Comments