MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 742526bc4de3287b0d55149acdc82c1578cbaae2c42066e40ac5812ed9fd3159. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 742526bc4de3287b0d55149acdc82c1578cbaae2c42066e40ac5812ed9fd3159
SHA3-384 hash: b9b4a6ae2593b2f020b5c156ae944c833fb4dc4178616afa6fbfe51d7577d5feac7ec063e4697ea67b73d4375dda189d
SHA1 hash: 0355bb6ef9509843f615b70aa744de99b742c52c
MD5 hash: 535e1a8e89ec6e8f99eb987b8c0135af
humanhash: early-vegan-nitrogen-connecticut
File name:5EAAwePAJ5qo7rV.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:909'312 bytes
First seen:2022-03-02 07:22:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:QG3vbzGEZDokt2g03pYY9Con4I3kQF7XIamg6:QyvbXZDobguYK4I3kQFT7m
TLSH T12515D05496D80A4BCB5B46BBD025D161C3FE98F592CFF78A4E92B0FD1E42390A81E353
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/246121/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.DWR.genEldorado.19001.32152.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/621f1b20b94fb38cb43631f2/reports/5fb869fb-e17e-4877-9d67-a99ca29317a9/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/818134fc-8ea9-456a-b431-2a8ea40e0098
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/948874
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
snakekeylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/742526bc4de3287b0d55149acdc82c1578cbaae2c42066e40ac5812ed9fd3159/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-02 05:47:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oqssnpcn4muhwdkvcsnm3sbmcv4mxkxcyqqgnzakywas5wp5gfmq._file
Verdict:
malicious
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220302-h69zsadge2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
369bf439a4387290bdaf10fcca0e4e046a2e81d8adde824804863f0b51414fb6
MD5 hash:
f55450dcd4dc8ff3ab6584aba9b1be2b
SHA1 hash:
95b6180f6e6a1e436509fa103a26cd8220394b75
Link:
https://www.unpac.me/results/643a87e0-0ed0-4f8d-8a7a-4765b0e5d4f4/
SH256 hash:
75d38a15dfcb7f9b69fb865cae862319295c29d6dab440479fd73a2cba5e5e5f
MD5 hash:
1f16b7bb3fadd5b9ecf974d999e0bf1c
SHA1 hash:
6895c07b1333d07a8ea49d6b66f115c649bc5556
Link:
https://www.unpac.me/results/643a87e0-0ed0-4f8d-8a7a-4765b0e5d4f4/
SH256 hash:
1ac60e5301dc14cfd11ef04c24a79486f17465e283e4fec812608ee27504e07a
MD5 hash:
75804fb0a5f5866ec3488d068d2123e7
SHA1 hash:
603297c70022bd88634475d125be407a8a128221
Link:
https://www.unpac.me/results/643a87e0-0ed0-4f8d-8a7a-4765b0e5d4f4/
SH256 hash:
f38f15a311f581db12acbfc94aed06bc619fde8d60ede04649138c71f902a5c5
MD5 hash:
24c3b3c42e33ba931b80a4c664b7e5e6
SHA1 hash:
0b80c1badd5ce2b7b3522ffeb55290d915196f09
Link:
https://www.unpac.me/results/643a87e0-0ed0-4f8d-8a7a-4765b0e5d4f4/
SH256 hash:
742526bc4de3287b0d55149acdc82c1578cbaae2c42066e40ac5812ed9fd3159
MD5 hash:
535e1a8e89ec6e8f99eb987b8c0135af
SHA1 hash:
0355bb6ef9509843f615b70aa744de99b742c52c
Link:
https://www.unpac.me/results/643a87e0-0ed0-4f8d-8a7a-4765b0e5d4f4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/742526bc4de3287b0d55149acdc82c1578cbaae2c42066e40ac5812ed9fd3159

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 742526bc4de3287b0d55149acdc82c1578cbaae2c42066e40ac5812ed9fd3159

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/246121/

Comments