MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 743515ad392665594a63eb8ce2432e2234733685d4d6c275c3d076f8b52182bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	743515ad392665594a63eb8ce2432e2234733685d4d6c275c3d076f8b52182bf
SHA3-384 hash:	9cdc22ba5c4c6166848568660fdcf741dca4fca61255ce7aad36cea50aa3e9156d0235b85f0bbc70c1538d62d54e1d51
SHA1 hash:	e9759e7a7babfa9b0b409cbe3b17a5a8c0263fa4
MD5 hash:	bc8974efe8eaf656b8a193b3de5e6cd7
humanhash:	ten-twenty-failed-don
File name:	Proforma Invoice.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	1'135'104 bytes
First seen:	2021-02-04 09:27:50 UTC
Last seen:	2021-02-04 11:43:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	12288:eP3w+24oEsHFYV4dQKK7v4k00sIxHplqGh/xZdFB9h/JkIS//SDeiq0D5kFkFwn4:GRoEslXMhlRlh/xZ7B9hGIMSDetMJP
Threatray	20 similar samples on MalwareBazaar
TLSH	ED35CE2033419B68E1FD47FBD130001097FA9405DFA6E45AADA949A4D27BEEDC2E173E
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

abuse_ch

Malspam distributing unidentified malware:

HELO: works.com
Sending IP: 45.137.22.121
From: sales@works.com
Reply-To: sales@mobileworks.com
Subject: 回覆：回覆：PROFORMA INVOICE
Attachment: Proforma Invoice.rar (contains "Proforma Invoice.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Proforma Invoice.exe

Verdict:

Malicious activity

Analysis date:

2021-02-04 09:30:26 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/fcffa046-05ce-47b2-b458-0553ab6a9018

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/115515/

Detection(s):

SecuriteInfo.com.ArtemisBC8974EFE8EA.21541.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/598950

Signature

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

May check the online IP address of the machine

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AntiVM_3

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/743515ad392665594a63eb8ce2432e2234733685d4d6c275c3d076f8b52182bf/

Threat name:

ByteCode-MSIL.Spyware.Snakelogger

Status:

Malicious

First seen:

2021-02-04 09:28:09 UTC

AV detection:

30 of 47 (63.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oq2rlljzezsvsstd5ogoeqzoei2hgnuf2tlme5od2b3prnjbqk7q._file

Verdict:

unknown

SnakeKeylogger

57eeb22b59b51f2ebdc14d10502d7b6b7ce20a4c15df666a97d1ba89fb16c3d9

SnakeKeylogger

60a77ee5b32933d4ecd4c6302f62d1ff9ae732b24350c67ac0b6b84f253a867c

SnakeKeylogger

7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b

SnakeKeylogger

9b673be5e2878f552738a2fa3c4a776c762e8686a5156be1feeb7b4e947fea2c

SnakeKeylogger

bd89f6e2794f0c383ca15b99c53a28d6b527be58ec713efcafff4f0db21959f9

SnakeKeylogger

be09092f910db9d06551f0705949487bda9c630e8b3124ef21ec7cb3e3d2bcbb

SnakeKeylogger

bf7ab488d2d80bdafaafb8c4dcd858ecdcbb81188142adc0d58f3389807f0708

SnakeKeylogger

c2163712140f5c8fad607b891c31478b96eac087753e4b1022004e0f3a053dcb

SnakeKeylogger

eb7cfe63ae7a7ad23a4de13e1b0649e0cf7737c07a133c619d30659230151475

SnakeKeylogger

+ 10 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210204-c6pcabjl5n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

962e0d5fa5ed802a6ee7a41f658dec2b00a0731235f918c68057b8cde22fdae0

MD5 hash:

d05c79f08da320bb966b444829646b00

SHA1 hash:

936364bf214e55e72869fccff6d31d88c6957954

Link:

https://www.unpac.me/results/8b37bbe4-dac5-4ce4-8422-87aa449049e2/

SH256 hash:

743515ad392665594a63eb8ce2432e2234733685d4d6c275c3d076f8b52182bf

MD5 hash:

bc8974efe8eaf656b8a193b3de5e6cd7

SHA1 hash:

e9759e7a7babfa9b0b409cbe3b17a5a8c0263fa4

Link:

https://www.unpac.me/results/8b37bbe4-dac5-4ce4-8422-87aa449049e2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/743515ad392665594a63eb8ce2432e2234733685d4d6c275c3d076f8b52182bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector