MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3
SHA3-384 hash: 05da0a524244b78ff02f7b52906996922163edcab223c8ccbcf0e672084e26cfa85732594ee185f01efad85466e51252
SHA1 hash: 22da991da46c925251c0d509cdaa6cad50e3ebe1
MD5 hash: 573a705d5e0d497295ea03ac32056f8f
humanhash: kentucky-lemon-cardinal-ohio
File name:triage_dropped_file
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:773'120 bytes
First seen:2021-07-28 12:51:42 UTC
Last seen:2021-07-28 13:44:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:qDQ5MUcOxaSrSfju1jHiLcEQFKZr7IxD97mY6jcbdd+cgfFKT2l5OCij0hXwTJur:qQ5MUcGtrSfiRJBI27mY6snpk7mo5oFY
Threatray 397 similar samples on MalwareBazaar
TLSH T190F44BE93224775FF697C37DC4B40C5DAAE0746AC30A8757F537809AAA4C987FA110E2
Reporter malwarelabnet
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
triage_dropped_file
Verdict:
Malicious activity
Analysis date:
2021-07-28 12:52:47 UTC
Tags:
evasion trojan snakekeylogger keylogger
Link:
https://app.any.run/tasks/36ca8d1a-061c-4e9f-9c92-29916bb6a459

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174640/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37307981.14481.29411.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/21a026c0-0fa4-4606-ad01-c13a0f15f8ea
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/823058
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-07-27 23:41:00 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
21fdc7575a436316c0235f3240191d0e4773e8a54d1d088c76cfab7c705bb0fb
SnakeKeylogger
3de2043d5dc6aa1879f040d9c69e905424acabe29ac4162752bbf57f83ae58a6
SnakeKeylogger
48b0e86fec639744a4907f199f83fda003f53d6d705a6f767e6796ab9e67bdd4
SnakeKeylogger
578aa3607cb34fde024d099b916e61c0a767d952312a2e8c9276f3167a65ad14
SnakeKeylogger
69950e3903237ab9d6441a23af192268cf49da8e1034f77990833a60738090a6
SnakeKeylogger
b5e1daebfb2aa234328dc9776a1ecc77dd2726a7709c353c0265d8b1f4803f1c
SnakeKeylogger
b9acd58a25a9493713c0b5a3be62db4338de550aad1b23054d4be3de0c1b0c46
SnakeKeylogger
c4e1ba047b2fa0d07de6a124e882025489d5ff95e2a2cef31c4526199636f3cd
SnakeKeylogger
dc5458e66a8c76f55a5f490f5c9d12ea6e92a67c6ed74dbe40ca066a149d1659
SnakeKeylogger
e0c5194ec5dd17f0a5f77c156e99deafdee0c6e25b5c54c4bedc7bc5420f3a1d
SnakeKeylogger
+ 387 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210728-7mldde92lx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
CustAttr .NET packer
Snake Keylogger
Unpacked files
SH256 hash:
63e37cc08574c1ccf793a883b7ac4fab3b08803da44be790c1e60ea907e70b8a
MD5 hash:
243259e2a2bfcf0ae60cc6d7b7d565c0
SHA1 hash:
edafcb5f73bc04327d8bd9bc504c6a0235adb3e4
Link:
https://www.unpac.me/results/bb1c6812-6826-41f2-94eb-043f666a1ca7/
SH256 hash:
4d6059bed77ebadb70092bd7a51de904ebb17ac822e22a08ee4c09352ae1e1c2
MD5 hash:
b0e4b1137e65d45c44f2a11575569aec
SHA1 hash:
d15be341c460239832bfae095e37850bd97015ce
Link:
https://www.unpac.me/results/bb1c6812-6826-41f2-94eb-043f666a1ca7/
SH256 hash:
97d2fa1d01b2f9a2199896e05e0cf60c14a9f41ef2d72e15fbb862b7afa08438
MD5 hash:
68463851c0e6fe7a254c99fae763d454
SHA1 hash:
4587a5371d88c296a0184fe47ee0c5245b187127
Link:
https://www.unpac.me/results/bb1c6812-6826-41f2-94eb-043f666a1ca7/
SH256 hash:
179f9b6161dc4232426b83766b5344a80711f28c17dbb36114890e087c2471f2
MD5 hash:
cf6904236026f2395a2393d8388fe405
SHA1 hash:
1885ff5159a15c7135b0f1cc14271b47062e48b9
Link:
https://www.unpac.me/results/bb1c6812-6826-41f2-94eb-043f666a1ca7/
SH256 hash:
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3
MD5 hash:
573a705d5e0d497295ea03ac32056f8f
SHA1 hash:
22da991da46c925251c0d509cdaa6cad50e3ebe1
Link:
https://www.unpac.me/results/bb1c6812-6826-41f2-94eb-043f666a1ca7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1484210/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/174640/

Comments