MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3
SHA3-384 hash:	f0d28907a3447d9e6ab8f1af0ea8146a15eaec21a23a54a4be093e67b0e0020c8862c1a5f35c8ba0677baa2b01827e53
SHA1 hash:	ce3f328b3906c98dab7bcef4207faa325df972b6
MD5 hash:	d7494334478e806ce5cae341378d608c
humanhash:	moon-arkansas-jersey-potato
File name:	Buni.exe
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	538'112 bytes
First seen:	2023-12-29 21:23:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:/VMRs+xI2T8ZJDDbrpsLCqxa78PAKuUHe:/KRG3NC+8YK4
Threatray	5'932 similar samples on MalwareBazaar
TLSH	T189B4D015ABE8533EE8F34B74F9F244676E71F94A3902DB4E2005A72D0C93B08569376E
TrID	27.3% (.SCR) Windows screen saver (13097/50/3) 22.0% (.EXE) Win64 Executable (generic) (10523/12/4) 13.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.4% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	smica83
Tags:	exe HUN SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

426

Origin country :

HU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Creating a window

Query of malicious DNS domain

Forced shutdown of a browser

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/658f38f3b855eb3693016201/reports/4f845d12-3ddf-4a59-b6f8-de694d46b5a7/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Snake Keylogger

Malware family:

Snake Keylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e279ff52-30a9-48bb-9003-e65f1ef24201

Joe Sandbox Snake Keylogger

Result

Threat name:

Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1368088

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Uses known network protocols on non-standard ports

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeyLogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeyLogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-28 15:46:12 UTC

File Type:

PE (.Net Exe)

Extracted files:

5

AV detection:

19 of 23 (82.61%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n3vzrjczw5izlccsyadskbpf2gd3krzxlhokadxsledfzekdgkrq._file

Threatray malicious

Verdict:

malicious

Similar samples:

13f500cb766e4c37869fb3286cbefb2c2ecefb4a799ef7e5723f574a842d5647

SnakeKeylogger

545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d

SnakeKeylogger

6a3eefff7806a0b03f089f6b53f17a1db9b6de86cb5c28c798a1b5244fbe7aa8

SnakeKeylogger

6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3

SnakeKeylogger

7eebc8928fee351d731226a9abbf7ce6e5833072b18721c603573fc8ff4c6e16

SnakeKeylogger

becd887276df85a4eea5b2837327ee6eea59f0f7579f7894a8307e4681b9b5d4

SnakeKeylogger

+ 5'922 additional samples on MalwareBazaar

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/231229-z81ybsdbhp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

UnpacMe snake_keylogger win_404keylogger_g1 MAL_Envrial_Jan18_1 MALWARE_Win_SnakeKeylogger INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_EXE_DotNetProcHook INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unpacked files

SH256 hash:

99b38f7e9d880deb8f2f2e0c7714a8bd57238045840033fdef9167f5275c9c8f

MD5 hash:

23bbf06eb791f32adb085fd633de97c1

SHA1 hash:

ed0810e5fefaeb82ae6efa2ae28006a47a865a16

Link:

https://www.unpac.me/results/7f4fe32d-b2ec-4bd6-a3b4-b7e5650e208f/

SH256 hash:

45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b

MD5 hash:

fb1bc19121c4e190d83672bc71b493f0

SHA1 hash:

c3488b969ba578e28ee360be24b6416425a224a0

Link:

https://www.unpac.me/results/7f4fe32d-b2ec-4bd6-a3b4-b7e5650e208f/

SH256 hash:

310b20a5abed2bdd0c8ad7596ff8ae46e6332c356762c71ba6fdf30f813b2071

MD5 hash:

a80bdd93bc7e526ca5e37ab3ab31b3e8

SHA1 hash:

31d916ab6e920790f7f3655e7c54930a0ccade57

Detections:

snake_keylogger

Alert

Create hunting rule

win_404keylogger_g1

Alert

Create hunting rule

MAL_Envrial_Jan18_1

Alert

Create hunting rule

MALWARE_Win_SnakeKeylogger

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Alert

Create hunting rule

Link:

https://www.unpac.me/results/7f4fe32d-b2ec-4bd6-a3b4-b7e5650e208f/

Parent samples :

2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b
71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118
f0df0ec243153f35a5522715fb79c372fde175ad98596185ec2eea5a16a535bf
f63b61933ecd47ebf5c5c79fb5e30c89852dc271dab0a6df17015392e1158293
545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d
becd887276df85a4eea5b2837327ee6eea59f0f7579f7894a8307e4681b9b5d4
13f500cb766e4c37869fb3286cbefb2c2ecefb4a799ef7e5723f574a842d5647
ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
fd3215fd4bcb33f2149cd4bed63011c2b992b5a008cdd289559031741e8a3089
43a5ebb280e2770fe10bbb4e598c80456f8fd86b720cf50ecef20d7fbc1423b6
7eebc8928fee351d731226a9abbf7ce6e5833072b18721c603573fc8ff4c6e16
aa733006f49afe10de1ea472aba0b3e8e8192bc59d3a3b244d6953d493e57be9
4e8b17d34495b7e4397939448da55c81d186794fa6a1f00a5e3cbd4659dd74ac
b2ca317d8e7369cd7f839b2db7df1e53b7535ae432ce247e933e8dfa8917e3f5
409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5
dc13c362ff576c7b7733c08175dd2f581ffd40aeb8b090823c18f04ece12ca01
576ca0fbe491aadd6c66a937af35e94d616d9dd9c079b3c7c617fa25b7010700
38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f
d805b874ab77c6272e89f57f5b6f080b039f42064a85778a7ff4bf436575cf68
6a3eefff7806a0b03f089f6b53f17a1db9b6de86cb5c28c798a1b5244fbe7aa8
6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3
8e84d73c7aad92d849e23543da0276e3a1abb8e7c8ea46197bcc01f7b7c4662d
1af4b1e67dee34e1ce541150c83e1be4f75766d47ecebf4b476cb08aa04fa837
5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370
4c91634a53fddb78f1737e66c0c323cdbc8d2e720a14732b8336e449ce062319
8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
7a66c663f71aff27ef5671579fd986b30c9527e23da7cbcfe7cdad8bf8baf739
4cb94e5cf28dc29ec74d5171838ec3735632812576708ec1bf1654b87b18215e
7dca5662fe7621ffd890ac202dd50e9d22b8f2ca186490ad62d8813cc0727cdb
dd2bb6ea65c082f25a75158f22c2d10e3be1daa026334a8d8e06007bbd245f70
b8410c46b62f3f4fa0255c4fa37c4899f2fa7ee69883d35bd178e629e2db24db
d85b912c5171741966d6c8238db04de39b56ed1b696ccf7a32400d34cd29338c
66b79b9bbc034503f2c6330157047506b561d119031d0dd9d03ff87153e01ec5

SH256 hash:

6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3

MD5 hash:

d7494334478e806ce5cae341378d608c

SHA1 hash:

ce3f328b3906c98dab7bcef4207faa325df972b6

Link:

https://www.unpac.me/results/7f4fe32d-b2ec-4bd6-a3b4-b7e5650e208f/

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6eeb98a459b7/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3