MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7651401ef8594540124a5a42c64653b9d8a977c331fe96aacb0a82e13e04be5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	7651401ef8594540124a5a42c64653b9d8a977c331fe96aacb0a82e13e04be5d
SHA3-384 hash:	085de23c7715b913176b06c5334b2a9ea25702070115bc08ef024f901b4b2cc89c5ab856dd6c9fb21a4acbb7812e48ad
SHA1 hash:	94ee8b298f744d11b6d99cd97bd120c2d510587b
MD5 hash:	ef1b2888f571c38d615b46ae5f436d0c
humanhash:	texas-colorado-early-lithium
File name:	gEfDGhJt0V3Vmi7.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	480'768 bytes
First seen:	2022-02-03 11:00:29 UTC
Last seen:	2022-02-03 14:53:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	12288:zF7p3akJ/GOOKv1Jc9CmunrWT104raCJJ:KkJ/ZNvf07T3zJ
Threatray	3'034 similar samples on MalwareBazaar
TLSH	T1B4A4D065FA974691F92A99313135BC5102773EE7AEC5DA181328F24C0BF37604F6AB0B
File icon (PE):
dhash icon	96d4acda6cb4dc0c (25 x AgentTesla, 12 x Formbook, 10 x Loki)
Reporter	cocaman
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

194

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/232150/

Detection(s):

SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

DNS request

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Creating a file

Sending an HTTP GET request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/702e4f3c-c21b-4cde-9d96-8cd3443fde78

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/933237

Behaviour

Behavior Graph:

n/a

Detection:

snakekeylogger

Link:

https://mwdb.cert.pl/sample/7651401ef8594540124a5a42c64653b9d8a977c331fe96aacb0a82e13e04be5d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-02-03 01:53:51 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Verdict:

malicious

SnakeKeylogger

79cb41c5d286b5e8062a31de81a893f221a8ea7bc887a74030b3802dbf5bc619

SnakeKeylogger

868d9db859d2b642c25a7cf671cfe4a14b100f2c5fa9b1f2847b7ecf436700b9

SnakeKeylogger

8a5bc3c75311f008ef8790b86807f8ba141ffe0c159badc3db9df7b930ed0a1d

SnakeKeylogger

db93a8cf5c8b72db62392b79b6d89f329801525af7a07e920505068922d00cc3

SnakeKeylogger

edb10d2dcc32d8eec38ad1db628e83ce08cfa41d9b973697853efbc3e868f86a

SnakeKeylogger

f6bd17e868cccb7e82fa32769dd5db9c5a8f2daf1676492b87c37d33e2565877

SnakeKeylogger

+ 3'024 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection evasion keylogger spyware stealer

Link:

https://tria.ge/reports/220203-m4ne8agbfj/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Maps connected drives based on registry

Checks BIOS information in registry

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

32b763e5b7b2cd561fa73990ba0ef9e6666af9da0ca37c2e2939772aa8a3b1d2

MD5 hash:

1d94c8fd3ef32b534da378b2bbb8a609

SHA1 hash:

f924a7d516ba3e4d6d22fcb78ef5aeb43037c5cb

Link:

https://www.unpac.me/results/2fd1983f-144c-425c-a1ff-bd34b1a5f6ba/

SH256 hash:

1fc1291e87d014324c529a6ce61e67068bde84497c3919527abc5c26f0d2bc95

MD5 hash:

1f8863a9ca0908e9a060b1a63bb41618

SHA1 hash:

8f00d8efde09a2e5528a2d7b0f9a716e45a5822e

Link:

https://www.unpac.me/results/2fd1983f-144c-425c-a1ff-bd34b1a5f6ba/

SH256 hash:

0cc119786b104cf0aa261a208bf38802b339774ff3d7a42afcd8329d2d7d21c9

MD5 hash:

263b5190f7ac42d83c756dcdf38147bb

SHA1 hash:

78f419fe3936ed7d603706c47230cd3e6ff79ffe

Link:

https://www.unpac.me/results/2fd1983f-144c-425c-a1ff-bd34b1a5f6ba/

SH256 hash:

7651401ef8594540124a5a42c64653b9d8a977c331fe96aacb0a82e13e04be5d

MD5 hash:

ef1b2888f571c38d615b46ae5f436d0c

SHA1 hash:

94ee8b298f744d11b6d99cd97bd120c2d510587b

Link:

https://www.unpac.me/results/2fd1983f-144c-425c-a1ff-bd34b1a5f6ba/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7651401ef8594540124a5a42c64653b9d8a977c331fe96aacb0a82e13e04be5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.