MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70a8964eccab1bdf1d93086e8ef308aa0f9504c34c2a0321ba6eb1babc89b55f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 14

Intelligence 14 IOCs YARA 12 File information Comments

SHA256 hash:	70a8964eccab1bdf1d93086e8ef308aa0f9504c34c2a0321ba6eb1babc89b55f
SHA3-384 hash:	2ba8814fdd09385609444904906b5989461513081629b4fdd6a582cf16e745ced52bbe990724cec5e9577bf3122689de
SHA1 hash:	bc70815eb2df0eafb5b23f9481a685f02ba08e5f
MD5 hash:	3139ab89611abdb5e284e7b4c9581a00
humanhash:	oklahoma-earth-bluebird-ack
File name:	bbbbbb.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	315'241 bytes
First seen:	2022-12-27 09:04:32 UTC
Last seen:	2022-12-27 10:31:28 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:eYa6BXhqubftAJVolTzJZ63EiXvTW16+tet4HvUB5a11J05dz4aB40A:eYzXhFDtAHAzJZ60YI6+fHY5I1+dz4aC
Threatray	5'401 similar samples on MalwareBazaar
TLSH	T18364125577A1C867C4734632AC7A053F2DAADD2022A4A3070B943B5B7CB2A13E81F763
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	70f8eee0d8cc69b2 (8 x SnakeKeylogger, 5 x Formbook, 5 x DarkTortilla)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

bbbbbb.exe

Verdict:

Malicious activity

Analysis date:

2022-12-27 09:04:41 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/e60f096b-ab2d-43e6-90b5-40085aa93594

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Garf.Gen.6.21940.26496.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a process from a recently created file

Creating a file in the %AppData% subdirectories

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Reading critical registry keys

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process by context flags manipulation

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Tags:

overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/63aab53f0fdf1633326c296a/reports/65e9840a-07ec-48c6-bc08-73b5f79e5a4c/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/454ab107-05db-474b-8cb0-f9676df01e77

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1141449

Signature

.NET source code references suspicious native API functions

Contains functionality to detect sleep reduction / modifications

Detected unpacking (creates a PE file in dynamic memory)

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/70a8964eccab1bdf1d93086e8ef308aa0f9504c34c2a0321ba6eb1babc89b55f/

Threat name:

Win32.Spyware.SnakeLogger

Status:

Malicious

First seen:

2022-12-27 09:05:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

13 of 41 (31.71%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ocujmtwmvmn56hmtbbxi54yivihzkbgdjqvagin2n2y3vpejwvpq._file

Verdict:

malicious

SnakeKeylogger

43b25aef4da392665de83158b04b5f705a913c9dd03bf777ea66540f8bd21600

SnakeKeylogger

7da5ff274247f3936df6b9d2225cc15e8990a4efec62f4f82147071fcab72898

SnakeKeylogger

9d4faa17adb02b020e7d9d7807a84ccb4e9285eb05f5cbae9ba7ee1e07d7b52a

SnakeKeylogger

a2e80fe784075653b12fd04576bd2927f9c55c22cea194b8263605daa3e7b120

SnakeKeylogger

b1d5ae49da3d9ff696452c791d1a45e3a6ef7715762b338707c4e8deeccde26e

SnakeKeylogger

b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3

SnakeKeylogger

c375bf8a18680d0924c42bb9186586c7a283e7fe5d694843a76ac28b7d7b68f2

SnakeKeylogger

c8e5da5d94006e08ab1bb069102abaac24bba18c458ad2253527a29380cfdf51

SnakeKeylogger

f0464f5e9669b4112215874eb7df62b915fe83a00e5365da6d8ecf7be9981388

SnakeKeylogger

+ 5'391 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger persistence spyware stealer

Link:

https://tria.ge/reports/221227-k155raee82/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Executes dropped EXE

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot5122580304:AAHkCWB9EFavZMQfS6pgdGmtEGk1zc21s0Q/sendMessage?chat_id=5138702702

Unpacked files

SH256 hash:

351c177e1f30548963110af6ce5cca28ed4283b4397957c8a483bff7676893ac

MD5 hash:

01d5fa34c0b7df2fea8ae7e10350e0a7

SHA1 hash:

6a22ee6fcea20dbd355882c7023be0df67a5a145

Link:

https://www.unpac.me/results/972673b3-762c-4ec9-9502-a855ce00c130/

SH256 hash:

1a07717d1acff577840c72a9e81de993e0058a8d454f4816f67273c7cd26d11b

MD5 hash:

eeb8723244bf4323cf7199fb3fcb9f9e

SHA1 hash:

475665131d7c513a6f62b5986a2ab318e8761a1d

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/972673b3-762c-4ec9-9502-a855ce00c130/

Parent samples :

b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3
b1d5ae49da3d9ff696452c791d1a45e3a6ef7715762b338707c4e8deeccde26e
70a8964eccab1bdf1d93086e8ef308aa0f9504c34c2a0321ba6eb1babc89b55f
77eba5c8f9099d4c9f2cbd300fb6d24e43c05e951860a88f17c4ffc97736453b
581c551c6629325cd764cdb54c101d3cca9150e1d22d16149d721b8e4da20e44
e6609ae5fb8180b336d2349a97518ff15ac1b7a60a022d5befd0a366040d2de4
b8a1bfdd85f3adf519fd1ba1ffbb60a4215bd3d930dfddac1caef7066fd33cef
bde58e12d41cd833eb907de3955528c3ba4ea45f7e825b6ca038f74eaf594d26
3b9b37912769526d5ca753f309018434f6d56410b88695472cdf6e948b9645f6
fbadbfd07054097238ecc6ed27a1e69e4907cbf038b4cc2ef52bd2f07085d0a9
92d153f7f41fa901887ec1494773140e4ef9b41378f2ec05deeb0ad8ec3f5d16
14105392349904938a9d2e42e5eaf8a401d2b832c89f14fb79440a7126525d57
c7d2461a20a6687bef74bfc784219676af232262762a102ae4f11765d2324210
535d74b24a5ffb30a283e855cbfdfb3509e9c94c4f97baa2f62197b221cce54f
1828a6afda383a1f6f48f9bab91e7f0d648fcef99f959b406618847c168e5325
efe80cf748bd25110797151a16a29b956213cc00a85716dae6e6008d648725dc
125ab5d56c8bc8e55483764a4fb9ad34ea9a74543e7b3a245c308703e5ee1d40
8556b28eb846e9ee99a00d6be977a7c76ff496a390e9a6f22150a6e1fb7c0d84

SH256 hash:

02de1e5d78583927a72877b9844a23898da6d8f68ab5b6548c7924274d6e5ee8

MD5 hash:

a1c95d38c1d72a80f1094ce0d42a43ae

SHA1 hash:

e1a2a54547d1fb1af26830413a3a5719c17d64e1

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/972673b3-762c-4ec9-9502-a855ce00c130/

SH256 hash:

70a8964eccab1bdf1d93086e8ef308aa0f9504c34c2a0321ba6eb1babc89b55f

MD5 hash:

3139ab89611abdb5e284e7b4c9581a00

SHA1 hash:

bc70815eb2df0eafb5b23f9481a685f02ba08e5f

Link:

https://www.unpac.me/results/972673b3-762c-4ec9-9502-a855ce00c130/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/70a8964eccab/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/70a8964eccab1bdf1d93086e8ef308aa0f9504c34c2a0321ba6eb1babc89b55f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AsyncRat_Detection_Dec_2022 Create hunting rule
Author:	Potatech
Description:	AsyncRat

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample