MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de
SHA3-384 hash: edd35d435ed3c542ea8ccf93b2a7470bb48cec15af76e4921a1f847761a1ce25c4dd8943374738c8c50af9598c3c1d9e
SHA1 hash: 836bd19c3ca9f5f7ebb39928836bb6869e4b054f
MD5 hash: d77ca3926bd3f1859f5c39f09d1176b8
humanhash: massachusetts-autumn-three-zulu
File name:Halkbank_Ekstre_20220111_075819_154055.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'072'128 bytes
First seen:2022-11-01 16:21:58 UTC
Last seen:2022-11-07 07:06:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:mOSPesY5/10vWwhuJpmQv9zps7SzE04MqMJXm2958TCEjAGKGzX:4es8d0VuJpxs7cEfMNYCSCOsGr
Threatray 8'262 similar samples on MalwareBazaar
TLSH T130357DD1F1A1CC96DD5B06F2EC6AA53011A3BE8DA4E0C10D2699775A36F3342709FE1E
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:exe geo Halkbank SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
339
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Halkbank_Ekstre_20220111_075819_154055.exe
Verdict:
Malicious activity
Analysis date:
2022-11-01 16:22:38 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/eee6dd27-fbbb-4f2d-ba39-bc362609162b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/326849/
Detection(s):
SecuriteInfo.com.Variant.Strictor.275740.3798.28799.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/636147ac58409ff7bc0c77cb/reports/6f7230dd-895a-4924-8cd5-65b97a391166/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c6b3ffca-a365-4fb7-9097-c71c4fafe495
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1102632
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-11-01 16:22:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
45
AV detection:
19 of 26 (73.08%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oq53ykusffwirnulv6wvp6hzm7kivtzvai7jxxh52hipt5tsudpa._file
Verdict:
malicious
Similar samples:
075d1ac0887f0028c537e2b45c1d1686d26e18464792ca65b374a4ac82261d93
SnakeKeylogger
09a476b31272d7aa3ba1e7f0a5ed54dda6834819fb360de18cd883fdb177686d
SnakeKeylogger
5c00ba81ba3c63b387be3c81b197a552de1ba46a1922c696d602e4fbf1700c01
SnakeKeylogger
6e3068d40a7f9cf1c1b32ce4c58931efe7363b9f2d9c96117c72e8c5fa90c723
SnakeKeylogger
bde44d28af8eea00ebb87e8a609fba8ed3e7371dfc1b5b842ef1a2aac4a0819c
SnakeKeylogger
e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30
SnakeKeylogger
e7bce95f8d0c0afe68c7073eb88a60271388885c07bd9a5abfcace139eec9e9f
SnakeKeylogger
f92f663f8f3a0eb9aa71214253b157153bc4c9b386e4189c00017ec85e9d6913
SnakeKeylogger
+ 8'252 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221101-tt757sdda9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5587666659:AAG8NrrXJQs__dhk8nLJBFOspz2my8OVpX0/sendMessage?chat_id=5569775004
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3cf9f16b-5537-4355-8e42-15123d1c474f
Unpacked files
SH256 hash:
6f4cb0bd5886b42756749643f4a6dcb3f6f9964a80782d8c58ce466e8855e499
MD5 hash:
15437b5e85a0dbca9d18a977addfe0f0
SHA1 hash:
6afa77379816ed8d4046d091a87fe1131063497f
Link:
https://www.unpac.me/results/57453aca-903d-4192-a653-07c947235bac/
SH256 hash:
22ed2d33ff3efc42edd8602f4f223f35da9673b4c79ff0cbed74b86d4f917194
MD5 hash:
36d0125da5cd14ea38f7a8ce5dc97d52
SHA1 hash:
684df4819a2cffd9e47b62ba88faee6f554fb0ca
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/57453aca-903d-4192-a653-07c947235bac/
Parent samples :
82e93820bcc88b4848f8f59f2c35d647647fd1227db2ab19a3f1e2fd896d6e7e
492f6e57a70f76bdfe306f542c58f9a98c68738bc30e30180a9d6c2ebd542401
e0cd24aec11fb4e4cdcd1e5932ca75ff201ab1087be33d3a3f94ed8e18a4eff2
e20f986eb07a1de8542737cbfeb6c959c941f2d4504e97bf05ccc8f0ce828f2e
a5102400568b0ec64884225f346921964b8fb4101db1e7dcdb2c7570f4161ecf
d1bbb9bd1eea0d574c0cd6a9d21f0a93e28b8d5be02ab39aa4671357d96b24bf
48ff3233c3694371ce56482b7d430918c75b4efe5f34b6f27877c878e43f4f38
c1b1bb430d273c5d98ee403072a3eb65ea39a0d0328e495d5cc5963d29e236d5
e53f8ac6297f4a8077eab28ed4997b81a4d91852c474618c58813a5891532adb
5e344f707afdedbfb16e731554ca97ff73407546bac845e9342d6932c6fd5a80
56589d4ad6f44f446964d2fa294809ca1e1ed2536b6c4f51edc4d0d8fc736a53
e5165182da8bd01399c69b5bedafcaeeadee92930ce267a3254edd1035a81dc1
736e89577a2db6e26bd174c180bd45af90e5686338c1207c543110df01a917eb
5b4d45802ea6070b703cb854278045a3528b7c1116e705f0cef2ed413489a4bc
34b985816a4baaa57d09048330b0c2a217485e20899aa36e7caa1d1494d171a7
914fcf53686f280284ed3b0313f62b1b84c443a95d65d1908fe5fee1f244a29f
8142fa023d2c326c8ff5cd9d50d10aff573e47d327ee466898411f60dc70a659
e0be66e9fe306de304b7f7b9227c124b9eeb9b0cf4afca86f64bdd057477ac2f
89bea1de7b7cc82a227134795589bf54792492d6d4ad81740cd551457ffdb2e5
f814f4fe8d450dc8cfc62cde57a5e4a2e72bb758f1c2d71f8483ab20315a571b
4c743eaedbc97613e8759c49e069f872bc786187cb2975a9564ab0aec2cd2205
22805984d67d2c9a896aca6d757a00e3adde2b538efd3b8a196fea685e9f9981
cf11ea9c0fb7a0bb58a7a426205f272a3d0f3572640d02bc4c925e23ae0d932f
7b65abc8f368961c4667c59072f5e35501aa3b8c5287246641d1b92a144edec5
bbd879991b1f6519e7fa6949fcb98604afe48667720394e3bec4e44cab9b3bea
d44d3dc5889b2f476fcd9413aef8041b692d28c11ae9f5f24018aeaebe35f7c0
499439f56127a77db15051a32a4b19fd43e98dfe9a3373dd008b60102a2d7d79
4fe0c19ffedd6a50fc9183a15ada9d4c1ef01879184e467ab5dc0392dc132c83
7a1be9cf221328688b575556f901eb33100299fc6488baf5a5c7b3611cad95f5
b6692385658a68fc7071fa263592322ff531ccf8267deccd9445a835b322760f
0ce000926ae7f2490881f580edeb841f172617d754fe24dac8305e22235559f5
26d40d55e47d0d62e5caa555615d6ec45bd5eefbc2e2f7d0be6736433ba5d0fb
6326a8dae7e332cd059ba1cab68aa5d50a517e7d09345cd1ccfb0f75c97bf4cd
4e9c0ce7fa6f96767cfee4ba612d9619b07e83267588d4f13b7f87269562e0cf
09f6ff9af9a4dddea8121cb0f20eb64c16b5d85386050a04354681b2799faf87
50b84cbf33aa07df940aa865fd2d59bd3154375e00f57e5e5a298e7971895879
4a758929930ecf0a804975bf90cdf639baacff62dc03692b358021bcd2f76735
743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de
279d0d374395dcf94a678ebcacffdcc0f1cee1ed2e02530826870f0841623fbb
05e2bda13b608d5981b145995723ba0cd44832b2ef4a0d2b6f0ab78c9c4d5b2d
ca218e56143dfab73d7066f98227804de7098df11a79658794d00b5358f56f82
898da3660c91d1e919cc0a330e6b9d9a00a72afc1f06c33cabee346d7c03df06
6c92c0a7566c67f67330f52bd2b3bcd86c5494126be9b66220ad73e7710de1d8
ea3605219638f6d67dde5ccedc1d1c12bcbf26fdddab503cc497aed1fc2ad9c6
81b3ee48efd3c8cc795f8aed301eebc2dc9409a955b34be0d2248fd7a837a227
eeee70d0a88095478c4ab938f5954151a3f18b86ecf23b2cd3ade775a1e5c9de
8fe1fbda137d7d1a5ee48332b6c076a9536537dd660239a251c1877ed886f0b9
184aff1b65ffdbd8c458dfd914d44a24c73956cdaade19d7539dda6bfc184cb6
7f43e21866f496de451febc54a4f637924417c3739a78adc590e5f0dc6222365
0f11dbfcf54ae858d3ea4c0e55024bf6970dda07577d06ee0340e55a4cfaf2e7
bf3d593e6c12541ff7c42c1398fd7d8223502cb019f9d8196f2429d86f1eb092
802015736c4eca25f3de84e123bb9272cf223e266ed63663aca940aae684d027
fd06e742f4084578228718b6f66aea3fe4ff11075bcdb83f3e7c235ea9e08401
57a6c53ce23f415d86edf60106317f3629c437453b184d076ea33a6815c3f269
00abddb5c44b7746ec241613dd44d23d6dfc796211083c4143916cb1d256cd67
7778b77cc307621ef43273a4e16fd9fa720c5d21bf4ad3c6ad916e1f6edda290
da6ec3d742185761a51b0186548d7fa81690f4a19f0977770955a804e1493f82
SH256 hash:
292a42f84257e4c023b19449f5747b9b4b8d9989b9bb3f565747de17753afb8e
MD5 hash:
52486363e6f92229aeae34c386b3a376
SHA1 hash:
fd39c62f8ee0e4dc825321c9a5e3ff5977f8b97d
Link:
https://www.unpac.me/results/57453aca-903d-4192-a653-07c947235bac/
SH256 hash:
15d73a776fe344c81d89f8c1403a88694e798a4698997b7e71ff8cd285043e5e
MD5 hash:
30f4d7c4a68786ee7add65357696b171
SHA1 hash:
f1dc5ea4551456140bda5f1be92ea156260cab2f
Link:
https://www.unpac.me/results/57453aca-903d-4192-a653-07c947235bac/
SH256 hash:
bc444c4ec803b91da7af06cb0eb233fe69f565067f89544bf750fc17a9ede6dd
MD5 hash:
b52058082749f08bbcb7036b0d4189e8
SHA1 hash:
90365baf6b18ff3139da00cd5caf30660643110e
Link:
https://www.unpac.me/results/57453aca-903d-4192-a653-07c947235bac/
SH256 hash:
743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de
MD5 hash:
d77ca3926bd3f1859f5c39f09d1176b8
SHA1 hash:
836bd19c3ca9f5f7ebb39928836bb6869e4b054f
Link:
https://www.unpac.me/results/57453aca-903d-4192-a653-07c947235bac/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/743bbc2a9229/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/326849/

Comments