MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7010546f9366fc5ff5ec208985159b5aeddc897e3dd0f811a6835c5debd96d55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7010546f9366fc5ff5ec208985159b5aeddc897e3dd0f811a6835c5debd96d55
SHA3-384 hash: ae50ae7bbca0060fe4095d6f7dfa9f8536f80fd7e442a1eafd2d6df9b95125532ac19114970515a016ce6c248660af42
SHA1 hash: e20e2054d1fccf28afa6e0d1acc01c76d9613c26
MD5 hash: 4ec76d5398fcc9e784c5b1f435c31741
humanhash: august-triple-seven-cup
File name:Doc-67789845678765670987655.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:152'872 bytes
First seen:2021-07-09 14:16:58 UTC
Last seen:2021-07-09 14:34:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6e7f9a29f2c85394521a08b9f31f6275 (278 x GuLoader, 44 x RemcosRAT, 40 x VIPKeylogger)
ssdeep 3072:jDxaVzwmg4CSW8JSuqX3bbKRfTkCgWSMr8zEY4RTSCRGQmsh1gtFFYj:nMm4CCgXrbISMr8zT2jR5zkFYj
Threatray 188 similar samples on MalwareBazaar
TLSH T10DE3025526A1C5E3DD7307B12E3A85B7AFEAB626107DEB0B53502F5DB902582E01F313
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Virus heuristic.heuragen.1141442 RE PROOF OF PAYMENT.msg
Verdict:
Malicious activity
Analysis date:
2021-07-09 14:06:46 UTC
Tags:
trojan formbook stealer evasion
Link:
https://app.any.run/tasks/104f6dda-b958-484b-ac63-2bef1f372f34

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/170683/
Detection(s):
SecuriteInfo.com.DeepScan.Generic.MSIL.PasswordStealerA.73B1F31F.24872.5370.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fbc6a9cc-8f3c-435b-89b4-082b8d83133b
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814033
Signature
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal WLAN passwords
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 446444 Sample: Doc-67789845678765670987655.exe Startdate: 09/07/2021 Architecture: WINDOWS Score: 100 55 smtp.azebal.com 2->55 57 us2.smtp.mailhostbox.com 2->57 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 Antivirus detection for dropped file 2->75 77 7 other signatures 2->77 9 Doc-67789845678765670987655.exe 1 19 2->9         started        13 idtreyc.exe 15 2->13         started        15 idtreyc.exe 15 2->15         started        signatures3 process4 file5 37 C:\Users\user\AppData\Roaming\...\idtreyc.exe, PE32 9->37 dropped 79 Writes to foreign memory regions 9->79 81 Maps a DLL or memory area into another process 9->81 17 MSBuild.exe 15 5 9->17         started        39 C:\Users\user\AppData\...\lhyfadbeul.dll, PE32 13->39 dropped 21 MSBuild.exe 13->21         started        83 Multi AV Scanner detection for dropped file 15->83 85 Machine Learning detection for dropped file 15->85 23 MSBuild.exe 4 15->23         started        signatures6 process7 dnsIp8 41 smtp.azebal.com 17->41 43 checkip.dyndns.org 17->43 49 4 other IPs or domains 17->49 59 May check the online IP address of the machine 17->59 61 Tries to steal Mail credentials (via file access) 17->61 63 Uses netsh to modify the Windows network and firewall settings 17->63 25 netsh.exe 3 17->25         started        45 smtp.azebal.com 21->45 51 2 other IPs or domains 21->51 65 Tries to harvest and steal ftp login credentials 21->65 67 Tries to harvest and steal browser information (history, passwords, etc) 21->67 69 Tries to harvest and steal WLAN passwords 21->69 27 netsh.exe 21->27         started        47 smtp.azebal.com 23->47 53 2 other IPs or domains 23->53 29 netsh.exe 23->29         started        signatures9 process10 process11 31 conhost.exe 25->31         started        33 conhost.exe 27->33         started        35 conhost.exe 29->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7010546f9366fc5ff5ec208985159b5aeddc897e3dd0f811a6835c5debd96d55/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-09 12:30:13 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
02b4c197d19e5147aa7e958b8d364936fcbf4f2a09ea7fc0773d417a6f9ac9c4
SnakeKeylogger
0ff8a0051138905969d6c762ab6bfb707348312de90884d4647c4168a501edbc
SnakeKeylogger
2e826b4ff8b272db629c4983e9edd53656cc4a2e9d24178ebd2b6a8890d1e864
SnakeKeylogger
44b5209fadd63026c1f4c7f1d1a6b9f49aa76f8597579773a0bc0010bada5853
SnakeKeylogger
549b1c385da022b7a956a88993359279d053227adf005eacc80e92d340921958
SnakeKeylogger
5d9ffac79344c0091b090160eefa292f87ed3462f24c6ff1b36386cd6a502561
SnakeKeylogger
79f15a58587f16c5153b32bdc4b571aa518907e091a60ff89160fa9776ee7915
SnakeKeylogger
9434ff752be66504d76e4404bc8d920748a6ae46a0e20e26c86753e8ff89b8ad
SnakeKeylogger
dda39c591898a0ba4531e89cd697021803df43cbe038570e2a5657f8a3400a02
SnakeKeylogger
e47294fb83f7abeec9f8e81cf403f70a35c3422252ea3e818066426fc75c5b6e
SnakeKeylogger
+ 178 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger persistence stealer
Link:
https://tria.ge/reports/210709-z7kbrb6z2e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Snake Keylogger
Unpacked files
SH256 hash:
42685e8af52d8dc140f557d8617a5254f7c875f271f457af42f4d17be9a9de89
MD5 hash:
c5ba313478199328c9db2af3c2424ef3
SHA1 hash:
cfbf8cb7976443c6fad24c29ef2ebc68464fa348
Link:
https://www.unpac.me/results/c9e3eefd-26e6-4fcd-be0a-ef0f236697d2/
SH256 hash:
6f51418feca3cc5f24ea3667e5b07f305b1538b4ca012f86c120b7f964f4dc2a
MD5 hash:
77acbbdbeaf933a72b10c4bf07e207e0
SHA1 hash:
02a77bc7ee5049c5febf7d548653216dc0ccfe78
Link:
https://www.unpac.me/results/c9e3eefd-26e6-4fcd-be0a-ef0f236697d2/
SH256 hash:
6f1db005b47e06c02ae6b804a88629ec52c372e111b586251b72f1c02f600f88
MD5 hash:
ffe86913aaab1fddd833d8d158f92a65
SHA1 hash:
e60bc609dc8f1d5fe23982ce3387f264a412e2f0
Link:
https://www.unpac.me/results/c9e3eefd-26e6-4fcd-be0a-ef0f236697d2/
SH256 hash:
7010546f9366fc5ff5ec208985159b5aeddc897e3dd0f811a6835c5debd96d55
MD5 hash:
4ec76d5398fcc9e784c5b1f435c31741
SHA1 hash:
e20e2054d1fccf28afa6e0d1acc01c76d9613c26
Link:
https://www.unpac.me/results/c9e3eefd-26e6-4fcd-be0a-ef0f236697d2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
Link:
https://yomi.yoroi.company/submissions/7010546f9366fc5ff5ec208985159b5aeddc897e3dd0f811a6835c5debd96d55

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 7010546f9366fc5ff5ec208985159b5aeddc897e3dd0f811a6835c5debd96d55

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/170683/

Comments