MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009
SHA3-384 hash: 7c9b68ad7914c1df82e4bf84a40cfab4c71694ebb9a2d56928ec507b00b3fef6156e870a3d725a6dffee5ae2a35fc8b1
SHA1 hash: ed808f2f8b9634e8a513401122ad8b03152742b5
MD5 hash: 34aad4cf4e2eaff477944be25df41837
humanhash: magnesium-glucose-helium-august
File name:Confirmación de recibo de transferencia.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:636'416 bytes
First seen:2023-04-24 14:19:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:buFqUvdP5Kq/XpKQKr2fjJswmvTPVj9Y/:bpUvKq/pKx2fjmwETt9
Threatray 4'911 similar samples on MalwareBazaar
TLSH T1F0D4BE1B222AD5B6D15E16B3D0E617FB0F1C2ECAEE7990430BA8BDD432727B91F48451
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:ESP exe geo SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Confirmación de recibo de transferencia.exe
Verdict:
Malicious activity
Analysis date:
2023-04-24 14:24:31 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/f0927911-719d-4cbb-8888-23f529f9adc2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/384565/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a process from a recently created file
Creating a file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64469014c4c1dca4284a69e6/reports/1c38b942-924b-4781-8186-f532a44a6783/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/407c750b-5a3d-45d1-a11f-4d8741d07e3e
Result
Threat name:
Snake Keylogger, StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1220060
Signature
.NET source code contains potential unpacker
Contains functionality to register a low level keyboard hook
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-04-24 09:06:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6sf4v5ayefsqc5o54wyurdetgrp2kpvorktls4ppyga2umfeaeq._file
Verdict:
malicious
Similar samples:
25dd001a5f16216d73a254e8ce18fbe6730d4570b5802b4c7ef7650f8fe17061
SnakeKeylogger
297bcb98149a7029793c38e7827aba52e746e97a1a0fa85ac80a7b97bbc247f0
SnakeKeylogger
321cacca1d81268ded64db8dfe9325631165d5000d4d2966564f6c6f7fb383d1
SnakeKeylogger
375203fdba98876072eda98a7a9ea4b5842ce5c12db292c0986e2af62241b1fb
SnakeKeylogger
40b6918926acd1dc22d7fd53f1898a63aa280380c76cf50b348825ff32739e34
SnakeKeylogger
4164d3bec950ac04c1a2e8edc8b4bccc4526daa5400e011c2622e9b08c720901
SnakeKeylogger
b559f2c5da63f93d113863c3328df3db4b81cc1e35cb68989ad06a19b9847014
SnakeKeylogger
b64fe2b2528d50876265ddebe4b4c14b0e78ae82c1a9c6c64849d0868f191815
SnakeKeylogger
ddc7c1ff2ef0f6881e292bed1fdd9f9eb503c9b2bf7d7960919b459012d572b1
SnakeKeylogger
+ 4'901 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger family:stormkitty collection keylogger spyware stealer
Link:
https://tria.ge/reports/230424-rneklacc83/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
StormKitty
StormKitty payload
Unpacked files
SH256 hash:
449edec2e2b1ed3639822e821bca13a202ac5631068a275347ee6ba740381153
MD5 hash:
4e6e4f7e501277bb1a81a59a2dfc54d7
SHA1 hash:
beebc64f78e8905239215994565bb6241f0071cf
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/23d24643-e391-4ce8-8714-b65a5705df42/
Parent samples :
297bcb98149a7029793c38e7827aba52e746e97a1a0fa85ac80a7b97bbc247f0
40b6918926acd1dc22d7fd53f1898a63aa280380c76cf50b348825ff32739e34
6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009
916813387ba52a892f9a9f10f3d709745bedf80adacd9e2c42869a1131535612
63d84d7c82a48d191d9ec89011493738347a206d68b07a03c5dfdbd2a23830a7
SH256 hash:
f305d35e83f26e2f9c413ff315ca71e37e38827bb1a0e1b6b584fcc6925d3a6d
MD5 hash:
25bcef517413927dad3a55840dfe6be6
SHA1 hash:
afacc8c7387809f8de65db337469de694327d919
Link:
https://www.unpac.me/results/23d24643-e391-4ce8-8714-b65a5705df42/
SH256 hash:
c8808b69b0f4d52c253e35b001da94086786b34162fd51daa3f17eda94bac7f0
MD5 hash:
da56041df789c24cb2a36a364431f766
SHA1 hash:
876e6c579d1092a76ce90c500c43af0cf11724a4
Link:
https://www.unpac.me/results/23d24643-e391-4ce8-8714-b65a5705df42/
SH256 hash:
5e5c8fe4e53980a98b48fe6b19155edf0f0d285ed899c61dbf4f880583ddf1d2
MD5 hash:
b3bbc5461d12f07ea893bf415dfe7c89
SHA1 hash:
40c3156c471d2afe3fd88c7d20cf93e5782e1bd6
Link:
https://www.unpac.me/results/23d24643-e391-4ce8-8714-b65a5705df42/
SH256 hash:
6baf0ba373fb1f827384d2b506ba41a0f923d4c01f224289aee0cebf2c5808de
MD5 hash:
814914ce1ebe330fc5866a53b7f3bc3d
SHA1 hash:
222c8ff15ca1759e0aebe1a5516384ec899b526b
Link:
https://www.unpac.me/results/23d24643-e391-4ce8-8714-b65a5705df42/
SH256 hash:
6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009
MD5 hash:
34aad4cf4e2eaff477944be25df41837
SHA1 hash:
ed808f2f8b9634e8a513401122ad8b03152742b5
Link:
https://www.unpac.me/results/23d24643-e391-4ce8-8714-b65a5705df42/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6fa45e57a0c1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/384565/

Comments