MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72caec95e98f61048c2838ebb0213717c41575cccd986f8fc1d789d4caef01a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72caec95e98f61048c2838ebb0213717c41575cccd986f8fc1d789d4caef01a1
SHA3-384 hash: a4e07be732c1260097d350ebe9a28b0c72a4b7f294953b6764510cc03034670f0f3a9475eb2f0d6d00ca079df74e817f
SHA1 hash: e1fe19ca716aee5d0e23e4ea9febf86307764fe9
MD5 hash: de941794760f98e49eef46ec3b7d3c65
humanhash: seven-single-texas-solar
File name:SecuriteInfo.com.Trojan.DownloaderNET.345.29836.20721
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:445'952 bytes
First seen:2022-06-21 19:42:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 384:wbLVFUsvvAqjyWk8gHcR26TD8WhMjNAW8dC7k7X6jM9858txGwQA5Alo:wboUv1G1r8R2JOdx6wJxGwQa
Threatray 3'333 similar samples on MalwareBazaar
TLSH T183946F8EBF0CC5ADE863CE7A965A364372A2714366F304D636DD5F3917D1A8D3810B22
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/282099/
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.345.29836.20721.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Creating a file in the %AppData% subdirectories
Sending an HTTP GET request
Launching a process
Creating a file
Reading critical registry keys
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62b21f5108903778452df339/reports/454e4a80-a1c2-43e6-bc2c-dafdd9ac7981/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea77c12c-7b78-4ff2-a086-e757837b021b
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1017463
Signature
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Contains functionality to capture screen (.Net source)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 649955 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 21/06/2022 Architecture: WINDOWS Score: 100 58 Snort IDS alert for network traffic 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 6 other signatures 2->64 7 SecuriteInfo.com.Trojan.DownloaderNET.345.29836.exe 16 6 2->7         started        12 Skype.exe 14 3 2->12         started        14 Skype.exe 2->14         started        process3 dnsIp4 44 srv60340528.ultasrv.com 212.224.86.32, 443, 49729, 49730 DE-FIRSTCOLOwwwfirst-colonetDE Germany 7->44 46 cdn.discordapp.com 162.159.129.233, 443, 49720, 49732 CLOUDFLARENETUS United States 7->46 26 C:\Users\user\AppData\Roaming\...\Skype.exe, PE32 7->26 dropped 28 C:\Users\user\...\Skype.exe:Zone.Identifier, ASCII 7->28 dropped 30 SecuriteInfo.com.T...T.345.29836.exe.log, ASCII 7->30 dropped 66 Writes to foreign memory regions 7->66 68 Allocates memory in foreign processes 7->68 70 Injects a PE file into a foreign processes 7->70 16 MSBuild.exe 14 2 7->16         started        48 162.159.134.233, 443, 49743, 49746 CLOUDFLARENETUS United States 12->48 72 Multi AV Scanner detection for dropped file 12->72 74 Machine Learning detection for dropped file 12->74 20 MSBuild.exe 2 12->20         started        22 MSBuild.exe 14->22         started        file5 signatures6 process7 dnsIp8 32 checkip.dyndns.com 193.122.130.0, 49742, 49751, 80 ORACLE-BMC-31898US United States 16->32 34 checkip.dyndns.org 16->34 50 May check the online IP address of the machine 16->50 24 WerFault.exe 23 9 16->24         started        36 checkip.dyndns.org 20->36 38 192.168.2.1 unknown unknown 20->38 40 158.101.44.242, 49766, 80 ORACLE-BMC-31898US United States 22->40 42 checkip.dyndns.org 22->42 52 Tries to steal Mail credentials (via file / registry access) 22->52 54 Tries to harvest and steal ftp login credentials 22->54 56 Tries to harvest and steal browser information (history, passwords, etc) 22->56 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72caec95e98f61048c2838ebb0213717c41575cccd986f8fc1d789d4caef01a1/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2022-06-21 18:39:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=olfozfpjr5qqjdbihdv3aijxc7cbk5omzwmg7d6b26e5jsxpagqq._file
Verdict:
malicious
Similar samples:
075d1ac0887f0028c537e2b45c1d1686d26e18464792ca65b374a4ac82261d93
SnakeKeylogger
214e07bc5d2f6f3f33beb0888faf7dceaddcec513d561cbe19e852640004cb1f
SnakeKeylogger
23ec2dfcb68af1ff78e6a2c9f60f01f89e3ddbf119c2ca9a20df319fb89afd12
SnakeKeylogger
7f7804a5460695dae61e378d733f0a613083e84c654ea6264a5276944b33f943
SnakeKeylogger
bf60eff9cbc2475c309dd1859de66cf161ed02669945ad33e70b237aa53ad662
SnakeKeylogger
c08897a775845aeff123fd3d6fa4864dc8fe76935c634cdc0299cb3fbff2b922
SnakeKeylogger
c6b830eb57c4bad87392f58857a37691511be8dab6cc595ce0052f6f6ee421a0
SnakeKeylogger
e081465f75b5fc1a981ad522ad595642d28c19df648d26c2694f6d09d8035872
SnakeKeylogger
e40d04897171c6b9b64d69ef3eb428445b6621afb24a9a58efd3e6cf1867f8da
SnakeKeylogger
+ 3'323 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence stealer
Link:
https://tria.ge/reports/220621-ye8kmsdhf8/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Downloads MZ/PE file
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5363562439:AAGVMiU4XYV-58gQyoNJh3zOsNSNx79x70w/sendMessage?chat_id=5417913617
Unpacked files
SH256 hash:
72caec95e98f61048c2838ebb0213717c41575cccd986f8fc1d789d4caef01a1
MD5 hash:
de941794760f98e49eef46ec3b7d3c65
SHA1 hash:
e1fe19ca716aee5d0e23e4ea9febf86307764fe9
Link:
https://www.unpac.me/results/52657a03-687c-48b7-81c6-e03c0b68971c/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/72caec95e98f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/72caec95e98f61048c2838ebb0213717c41575cccd986f8fc1d789d4caef01a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research
Rule name:SUSP_Websites
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference of suspicious sites that might be used to download further malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/282099/

Comments