MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 795280757b94b198f3622a87576e76100e869f3ff8160c2f72bafba588166c6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 795280757b94b198f3622a87576e76100e869f3ff8160c2f72bafba588166c6d
SHA3-384 hash: a76149eca9e0b7b0028dad3217935522290f19e24a4423d3f829576bdac6fbf82cc830a1ee7996b54fbdbee17dafa3c2
SHA1 hash: 42616ad8378bba9cc36d9b50595f15537aaaac11
MD5 hash: 85732dc59dd16fe0e7833c25a1e6dcb4
humanhash: blue-india-uncle-arkansas
File name:PO098762_xls.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:611'840 bytes
First seen:2021-02-05 16:31:05 UTC
Last seen:2021-02-05 18:58:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:8sopSDMpra6o6qsLn1RVbcNeXUrKPwbUVa1wM2qawLZScRAV3lwoMGA:0p1o6fgNKPwaQwcQA
Threatray 11 similar samples on MalwareBazaar
TLSH F0D46C3C758B8CB3F0DB7DBA56AC502A7BB19C16E685FE17CEE0818A4F329D04255643
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: secureserver.digitaledgekenya.com
Sending IP: 148.251.164.94
From: Anoop Kanaujia <finance@multilinkindia.com>
Subject: RE: PROFORMA INVOICE
Attachment: PO098762_xls.r09 (contains "PO098762_xls.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO098762_xls.exe
Verdict:
No threats detected
Analysis date:
2021-02-05 16:38:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/15c63eb1-a173-43dc-9e65-81ad812a3d9c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115763/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.6999.12674.24798.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/600455
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/795280757b94b198f3622a87576e76100e869f3ff8160c2f72bafba588166c6d/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 03:08:31 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfjia5l3ssyzr43cfkdvo3twcahinhz77alayl3sxl52lcawnrwq._file
Verdict:
unknown
Similar samples:
12f55950dc52aa9e607fcc04d3d2d2a58689a7ad8c1adbf58d04ac0c452ed5c0
SnakeKeylogger
1dd86f0bc8a9e1a5a7286cc1503b0713f3a44ff4050265da57d5ad8a26f9f46f
SnakeKeylogger
319317193be5eadd1f42f45e397d611c995452308320606c5f6e7d97869b6c8f
SnakeKeylogger
7e57934a39e0526d67e204b9fa5a6a65b901b05ee1faa540f2a6e5ca348f136f
SnakeKeylogger
972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef
SnakeKeylogger
a8aad152f516add6a277e2634baa324b105a90c3b02935aa2fa11ea4f0c4667e
SnakeKeylogger
bc8df1915282e2e0682f70a348b91aab8282560beee4fd5f7b972cbc8240993a
SnakeKeylogger
c10cdab79d291209250dbe8cab991843dedfdf4291d742e7764ecdcaa910b9e5
SnakeKeylogger
d15fa8ff467270abc9ba8c36038c455d2ad1de137748a1cc886e5f148a3a3fd8
SnakeKeylogger
edb743711a79b22830152304a71da9c88c4803ceb7081d88f326173857287bb7
SnakeKeylogger
+ 1 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210205-wqn4gbwyx6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Beds Protector Packer
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/2ed7f411-6b95-4760-bc21-5ed89f233174/
SH256 hash:
f09a19ba8ecbbaedeae2dbd46a9c5e93ca5f9c401df1272d25f3fea27792a412
MD5 hash:
90e0c8410e8f438d44ee6155992233a5
SHA1 hash:
c14d7c2e1a75dc0218d1eac57720cf9dd6baba7a
Link:
https://www.unpac.me/results/2ed7f411-6b95-4760-bc21-5ed89f233174/
SH256 hash:
f8542fc0c0ecc65698eae219888c0b05d9fadfe379faab330b0713abce2b2733
MD5 hash:
afae8b736fd50baf2a41f6a8c11663c7
SHA1 hash:
99d9f37e66334a84ce360091880d61f25a4cb461
Link:
https://www.unpac.me/results/2ed7f411-6b95-4760-bc21-5ed89f233174/
SH256 hash:
795280757b94b198f3622a87576e76100e869f3ff8160c2f72bafba588166c6d
MD5 hash:
85732dc59dd16fe0e7833c25a1e6dcb4
SHA1 hash:
42616ad8378bba9cc36d9b50595f15537aaaac11
Link:
https://www.unpac.me/results/2ed7f411-6b95-4760-bc21-5ed89f233174/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/795280757b94b198f3622a87576e76100e869f3ff8160c2f72bafba588166c6d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

r09 86ca52bdea020c97777f005037b67df71b0feb8041a8bc9a8b9d91b385ef507a

SnakeKeylogger

Executable exe 795280757b94b198f3622a87576e76100e869f3ff8160c2f72bafba588166c6d

(this sample)

  
Dropped by
MD5 fde656c6173fa88b6caa5295459e0208
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/115763/
  
Dropped by
SHA256 86ca52bdea020c97777f005037b67df71b0feb8041a8bc9a8b9d91b385ef507a

Comments