MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85
SHA3-384 hash:	05a84c2732218c4a91965e77186ffe08792b3b78cede5abf6f09af72d4d801eae5cf8bfc78eeb0fa9dc13f2507b41f9d
SHA1 hash:	22b7a7f89c868805ff5d838790aa7f6b40120288
MD5 hash:	803beb75e78efa0450bd6bf0fdd5cae7
humanhash:	ink-item-bluebird-vermont
File name:	Quote - V-23-IPY-081-E.exe
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	633'344 bytes
First seen:	2023-05-11 18:30:38 UTC
Last seen:	2023-05-13 22:56:11 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:imYCfCIoKjm1+qd+kfHlrRk/oTAqy7GhDS0R2gK5OY3pP9tKg:imNqXh1+lkfHlLTAxQSK2
Threatray	5'230 similar samples on MalwareBazaar
TLSH	T14BD4D0886237B8DEC455867165543C628E3D7123727D60BCA42B748CCD9EDA2CFE4AB3
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	4f07090d0d014f8c (47 x SnakeKeylogger, 17 x Formbook, 13 x AgentTesla)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

244

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Quote - V-23-IPY-081-E.exe

Verdict:

Malicious activity

Analysis date:

2023-05-11 18:36:24 UTC

Tags:

snake keylogger trojan evasion

Link:

https://app.any.run/tasks/d9537300-f880-4965-b7c9-f3a9608d7e00

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Snake

Detection:

Snake

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/388478/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Strictor.266117.25746.11406.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

barys comodo lokibot packed

Link:

https://www.filescan.io/uploads/645d3475b87853d1e17b6607/reports/3625b92f-b604-4d23-a3f8-1db7f19199c9/overview

Hybrid Analysis Strictor.Generic

Verdict:

Malicious

Labled as:

Strictor.Generic

Link:

https://www.hybrid-analysis.com/sample/750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Snake Keylogger

Malware family:

Snake Keylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a54ad69f-b373-4622-8b30-ecfc0a7c4922

Joe Sandbox Snake Keylogger, StormKitty

Result

Threat name:

Snake Keylogger, StormKitty

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1231173

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected StormKitty Stealer

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85/

ReversingLabs TitaniumCloud Win32.Trojan.Strictor

Threat name:

Win32.Trojan.Strictor

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-11 04:37:49 UTC

AV detection:

17 of 37 (45.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ougvir5nvywcdabnu35wu43u6ucwhsqm7gjyeuinmdhzzfezlkcq._file

Threatray malicious

Verdict:

malicious

Similar samples:

10bbbb979fe5c51ef5402549101a4460666e9be265d430d1214c93ec0b6ca915

SnakeKeylogger

351c0e2125e4a520bbe97ba66e4596f6a95fe1f52e2fafb7baef5cc0034aeb19

SnakeKeylogger

55e427b25c25bcfe1b0975adba359a3790ebdbc0f2e065d3e0c84ccda77d5c1a

SnakeKeylogger

886a8581f310f5d4244c1f263a9e2bbc2d759bcc8078351990bf7ab2f1c1e717

SnakeKeylogger

97b9854240d147393cc47a0a37bbca4bfaad2233f87d45da15784b9750321039

SnakeKeylogger

9e5f01fcd9e6ad2a133b43fc012dd7f72fa09e87dbc8d5f98c2a6325e843affa

SnakeKeylogger

a157b66148722c2f558b4946c120ccca8681cf2c5d51f43483732e3ec7c561e0

SnakeKeylogger

b050f56ceec41d0c409065b66cf598cbaf75a565afab1b47552624e085a3a9c4

SnakeKeylogger

e3d6bf1ce9fea9bd1248afa6e927a1d763a3e0e899be2f0c0c77d12de4870654

SnakeKeylogger

e64d2225119a5860cb2d7a12914d0834d174a72d387e84b58e3d94c89aadbc58

SnakeKeylogger

+ 5'220 additional samples on MalwareBazaar

Hatching Triage stormkitty

Result

Malware family:

stormkitty

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger family:stormkitty collection keylogger spyware stealer

Link:

https://tria.ge/reports/230511-w525fabd4w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

StormKitty

StormKitty payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot6221660400:AAGb-WADrhdDFxd9kxzjtg3jdDw9-uvNVlM/sendMessage?chat_id=6200392710

UnpacMe snake_keylogger

Unpacked files

SH256 hash:

3ab1dcc37e7c5c643bf41e9f0f81f816f24974fbddde95e2af52426e3374dd35

MD5 hash:

8a2c496875c0871aecc16aae768b323f

SHA1 hash:

f5423a32125c70b512de301c5616c7b75477e2e7

Link:

https://www.unpac.me/results/867e3df1-c3ea-42cd-bf36-98c32d744c36/

SH256 hash:

e3d6bf1ce9fea9bd1248afa6e927a1d763a3e0e899be2f0c0c77d12de4870654

MD5 hash:

2ace3fe2cb033a797bfd6749dfba2c2b

SHA1 hash:

e2ba08dbdba347cee4f3a14b6531032d6c35c9f6

Detections:

snake_keylogger

Alert

Create hunting rule

Link:

https://www.unpac.me/results/867e3df1-c3ea-42cd-bf36-98c32d744c36/

Parent samples :

c45857bf418c526b5652d2efea575e9c396fd9f46402b48cae1315a59dc13837
78ff2f0f8d66532c03451f447a0cc030363cca6ad195ec248d1d64dda9afb2b4
1404d60fc92ad4f5e3059a37a50bc70803f25404635f969333b4618b891e64bb
e3d6bf1ce9fea9bd1248afa6e927a1d763a3e0e899be2f0c0c77d12de4870654
3d73a129f1b19aed63491b61d5a1c7f50385b90eb7d6eb996b1fc56f5738ed17
4bad07a175eeba8f014690c8856ba9210c0b8165ea7ddb3162ae78ea774fa122
351c0e2125e4a520bbe97ba66e4596f6a95fe1f52e2fafb7baef5cc0034aeb19
dce7af2c2162f2fa2be0ca63706446e0b3c4bebdf1ae8791f22cb76ca7aa375c
70b86ae1a2b54a630bf94ed868958fdc478fa15368b29a8fef0953518fc64dad
82a9b190644c8424e65714aaab0bfd3d60cf0c4f1e4baa0385f4942a08f4f6cc
a664143868ba14df65aac079d2039c105c2450ae12d0cbc8b0ba75ce931f734e
9cf00726354c301f618cbec84d26ff15c79ef3e488082c64add590eaf3cc007b
fd36e87f08b87a1413854b9763d7603f12be2b5b15d2d4f87537d840faff3123
06bf0a18fa2bb4779e3c3b5efe493cc77014366ce4c54b40faac7ad7bc20e8af
55e427b25c25bcfe1b0975adba359a3790ebdbc0f2e065d3e0c84ccda77d5c1a
17bdafa051fda4bc7b9d9aeacd211dcc47622b2977d3feda560bc08b4ed6e7ae
750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85
8760dd4d037c34998c16fea312946f0d6d05c2d3b25c1acd6dec12d00e376acc
fce6b63b365250cc6a683218c392db940ced75fdda52be9841f70220dab8d2d0
95aaac69a74579c44bfde7a517cebb7d632e91b747369f7a0b888bfa59328d7f
5934d8422293fb25ce1de5eaa80a43ebc0113df54f7ca06e8ebdd9880d3f72d1
db5a4b5c89e2984ac0be6e61a93dcd9ab7bb42d81ca6083b4388ae962ec6ea27
560b81b3d1a32b87866411076696f07732fedfdfcce590cfd101add2844985f6
94b7f2d4caed8498f176776f2c6384ad72013461e8e87dceee2248fb9f9d86aa
68b61b3391e5fad5d50cbd18853fabf24c68f7adb9df0dbb44a29d810983acfd
a2b90a437fe9f0a39bd7b472aa9ffad9391806a1de172df409c8c3e411e9c590
48a934365319e7635802c12c897d5ccb5a58b1317f69bb15e047ad66588c0388
781a87071f2c6ad4c8dc5b29de67f6cb8062b3ee4d3521bb5dd6f870ead5dbbf
4051cb962adc56da0c94bdb3b81fe0a0cf4d4b5fc0652289513a3691513bc0b8
1f53cffa281a18eec6149e2fc33e25cb597281c536825156696a5fb6f48b59a1

SH256 hash:

900b4a459ea51dfd1e1d0c6220b97004e7f0852faf44620f876a4d8ffb2fcb93

MD5 hash:

9af0c8fe4d364694282cc39963732fc3

SHA1 hash:

923cadc9706b344c337188775bfdcb58dc5b6f1c

Link:

https://www.unpac.me/results/867e3df1-c3ea-42cd-bf36-98c32d744c36/

SH256 hash:

b523e2eda90ca34551da40232cd5d7a78c283feef0089851a52d6dbb9ded3eae

MD5 hash:

1d493f3ac060e519f97e2b75ce438e3d

SHA1 hash:

4d7c87926db6eede2c62360cfacb583392c521ce

Link:

https://www.unpac.me/results/867e3df1-c3ea-42cd-bf36-98c32d744c36/

SH256 hash:

d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218

MD5 hash:

e5d93dadd08b8bc727e4f4853c6881ba

SHA1 hash:

27e0e057d33f01586193b0cbf06561c2863951f4

Link:

https://www.unpac.me/results/867e3df1-c3ea-42cd-bf36-98c32d744c36/

SH256 hash:

750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85

MD5 hash:

803beb75e78efa0450bd6bf0fdd5cae7

SHA1 hash:

22b7a7f89c868805ff5d838790aa7f6b40120288

Link:

https://www.unpac.me/results/867e3df1-c3ea-42cd-bf36-98c32d744c36/

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/750d5447adae/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Password Stealer

Threat name:

Password Stealer

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

exe 750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/388478/