MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 790027b5d9e45f536c779d6527483930da9e3b5891f5a5767363d496a1d528cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 790027b5d9e45f536c779d6527483930da9e3b5891f5a5767363d496a1d528cb
SHA3-384 hash: ef74d71c5f86484cc85f54d7492b2f85d8e71751352e8352f5cdc21ebf51f1a1596dbf02b1124a7dbf49d055ef539fd1
SHA1 hash: d462ee15c9ff740b6c912aec09bb97f079807410
MD5 hash: f3a5b02cf1e06f49223189a515c811f2
humanhash: ten-maryland-mockingbird-sierra
File name:SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.15340.30673
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'263'616 bytes
First seen:2022-11-07 02:56:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:D5wJEPYgFhkdkzTwI6CJH/Kf/Fbp+ebI+xoi:qkhNT9C5pc+e
Threatray 9'532 similar samples on MalwareBazaar
TLSH T1884549017756FA10E1E606F3C6C6ABA45E74AE113D01FCDA28D5A3CF4236BD1F8861A7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 7169e8f0f0e86871 (8 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.15340.30673
Verdict:
Malicious activity
Analysis date:
2022-11-07 02:59:27 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/080fe95f-224e-46ec-aee5-05d8ccb8b0db

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/329646/
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.15340.30673.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63687403775605b3a4f3d20d/reports/be82be54-a06e-4d8e-b3c9-52e327730016/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea276c3f-d880-452f-af9c-63b44a79dc53
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1106892
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/790027b5d9e45f536c779d6527483930da9e3b5891f5a5767363d496a1d528cb/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-11-06 23:50:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
52
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=peacpnoz4rpvg3dxtvssosbzgdnj4o2ysh22k5ttmpkjniovfdfq._file
Verdict:
malicious
Similar samples:
1d1f8cd03f7d4657ff1e304e5bfa47a7affa34e3d7b093aae1d31f489550dd98
SnakeKeylogger
50da774fda04ec1034035862f80ea8933397e34b66ac58c239c369836e341be0
SnakeKeylogger
6069a9d373b71c1217c3415634dfadeed9cfa0baa4949d640fe515d92b5a8a27
SnakeKeylogger
658cb26b4f26e4ecf21c85c6138ceb52c614ca4092a69c365d324ff0b4b0d7c0
SnakeKeylogger
7319a8d431cd1a967b517cd21b9aa7c0f86b1716e7e2492dd2e831a65406c460
SnakeKeylogger
7c0ccddd1e886d81fbcd8e4c62e6d61ce7e78258825a1f2ef1bc7edca4179cd5
SnakeKeylogger
a7f4f456189098240111b09c4a1564fa8d253bcbdec92f8696826717a88c9b56
SnakeKeylogger
f293c00ae925b1e3160d4104f35de999a31728aa5b636dd945d2ceb1d5045c01
SnakeKeylogger
f5b5997f3b718acf9ad712558e910e0d0c4777d8882207c05510f6c42cb3013d
SnakeKeylogger
+ 9'522 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/221107-dfk6hsdhf5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5484820495:AAGEjy8dT72vJZImmHLmeh3onMuG9LLRD5A/sendMessage?chat_id=5101327412
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/358ea723-61aa-4d43-95c8-90f2345f0a1e
Unpacked files
SH256 hash:
e43d8d7fc9592084354784b05443a1d32ef2ecf822c7317886fdfe09bec33260
MD5 hash:
a1c59d57bb339db4f37c6bd74572eb1a
SHA1 hash:
b6f583f546b7df26c0929a8b4c4806314d5639ab
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/21c66bc7-7b0d-4fea-ba6e-2862ca87ad65/
Parent samples :
38950a141d412584636b4e97742db5aebe480e9edc467ef5b532e0216879f44a
7241d8e398ed2bc2973ad2f9a905d5bfdce3b02fcaa3b60c0a4ef1fd194f51ef
f913943b5082aed8ba09b537e3d9328a9f6894dc3ab93a1defb3f43a69078eb3
7776ae6f6274f264a686785c2970782847826bdd9c6a3cbcabab0573f449c174
962b66d01dbbe1dd3cd85dcbe030c318d2f685fe5a965133279f5afb3b6adb94
b4fde3291600549dc094b96ea4afd8520afd1cc16bf7196faf2e11c6281b9b8a
514962de0cfcafea5c6a6ff3c7162c8a9ac2a7362f44812c9f74cf92092c0af3
b44211d828b159e40ceac13bcc9f4090aabb146c02d06a0836cba88bc465c88e
2eaf90482aaf8c1c7ee6ac3533c0c8831e8848d280e0e243829bf24c1393dd63
0ce4d6e8ba3ba2d916a91b04d863bc33727ab419f3f8013b3cb610bd49a5b104
6555c5be3926aa465cffc7d5ac89f0bc94ed54155525281141ddc3ec9c6bf33f
6deb2bb7b87e2cb22966a1cd3c54a04948a36474c017c1a6cc622df6b928211c
95f955291eebbed5c72e6956296cba4ac8e169ecab4881a93c9938834a56549a
f2fbf3aacd32bdcd8dc22abc45d879eb863dff437484913e1242bb6f277f1b53
790027b5d9e45f536c779d6527483930da9e3b5891f5a5767363d496a1d528cb
64c749751bffaa96432c647beb4f8ed81a7c811bc6dc0a6763f44455a7c4d5f3
9f5da29a4b91ad8996aa600ac824a5667400dde0076bdff5c5b27652f0df000b
eec2c52990c31a2482d0acf15788db765b705baf2bb149d5cbe013d8c055c51d
b8216cdc194ab1f82820fc2a29ca63af3a1f3e6b80102ab658c1ee33b7dd68da
38b404c76de7b2c70cc770583b5917deefe31be51acf2caafc39b3fd884a9ede
8e603a99770c15419c36fd082b789d2285e7ddfd77da47cf9f9be899c350d913
a93b70eb6d8b21e04163be6ebc444ff76a557040e8d97021ec04a5a002cd5c8a
06cf43a592776ad9e34f1efc2cdbf859599710b25f395d871b5a5e13d88b30d8
24704e7cf611284dbe00a83b66ade87369dfb967016da89e78add0f004e5bcb9
284a1c6b11e8c221f4ab44da36c5b12eb6941d575003de79e918fd1a47a0cd24
2200860726cd8b2d878f4194b29418ca4cf2b2ca056ba21d5fd34ce3362b9c7e
9ae533dd395882eef0df206750f1fff09e5eab9a4397515632d15fd248f72ca4
34b91aa79335759905f9405680460480b9d3a759c32e972192c0e6c41f3d7c36
2b0d30ca1ad2a366fa11c3808abe98aeada07d82b17361cba2e01cf21c9992eb
8afbcd46ec9038c7e7479677a5b440764e3e61a9c99fa8b22c816727a21b17a6
682d2d533c6ebad2e51c0261add6a4b633e0a0b3149cb3396b20271d6b87470b
a9498e6102ca86f0b3500796103e30d7e7f4b955441711450f3228ea06e2b8ac
SH256 hash:
a327516357b9fa1a75753b3fbd0030e13f374be7cefcdf983d0b731f278b0c59
MD5 hash:
404efdeb9931733904da07f96fabeb72
SHA1 hash:
7ce363cd612f1d9a90b33ec196c4d0a49cdaee02
Link:
https://www.unpac.me/results/21c66bc7-7b0d-4fea-ba6e-2862ca87ad65/
SH256 hash:
6f3a48e8b99c79d43dd1f2088b9e52a0a013549941f459a7f23af3e6f050db91
MD5 hash:
09f21e2320ce6244b186bd240113b20d
SHA1 hash:
374735bff1894eb21ab3c114193407babe8da0a4
Link:
https://www.unpac.me/results/21c66bc7-7b0d-4fea-ba6e-2862ca87ad65/
SH256 hash:
790027b5d9e45f536c779d6527483930da9e3b5891f5a5767363d496a1d528cb
MD5 hash:
f3a5b02cf1e06f49223189a515c811f2
SHA1 hash:
d462ee15c9ff740b6c912aec09bb97f079807410
Link:
https://www.unpac.me/results/21c66bc7-7b0d-4fea-ba6e-2862ca87ad65/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/790027b5d9e4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/790027b5d9e45f536c779d6527483930da9e3b5891f5a5767363d496a1d528cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/329646/

Comments