MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33
SHA3-384 hash: f0f30a74bf4324efe31ec724f1ff3417504526c5e377a79ce35f267aca9fabdd13a724c9d009b9b491895280fc7eb6f8
SHA1 hash: de675a2e334b5d1c30f52184cb1b2c7c9e071656
MD5 hash: 51bb2cd3a440b03b8f3395668bb7ed44
humanhash: dakota-four-crazy-thirteen
File name:VESSEL DETAILS.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:553'984 bytes
First seen:2023-05-02 09:23:07 UTC
Last seen:2023-05-13 22:58:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:VOhXGPstv/uHCuBHzmZ5i7TzVx0vq60btUP+2wuZ9Cb6rh:GXGrxk5iwq60btW7//h
Threatray 5'069 similar samples on MalwareBazaar
TLSH T1F0C4CF066165CF1BFD7A8BF19474FF8463F0B07365E4E1282FA620C6DAA6F101E4991B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
227
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
VESSEL DETAILS.exe
Verdict:
Malicious activity
Analysis date:
2023-05-02 09:33:51 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/41702184-4d08-43df-a270-eb33c97cfc46

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/386014/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/6450d6b3961a21dc785c5cf4/reports/b0fe5fc3-c0ef-49e3-a86a-a01f15f325df/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e873614f-33dc-4491-8a94-03743d60242a
Result
Threat name:
Snake Keylogger, StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1224573
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 857536 Sample: VESSEL_DETAILS.exe Startdate: 02/05/2023 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 9 other signatures 2->55 7 VESSEL_DETAILS.exe 7 2->7         started        11 xTXuqPdjAiGmQt.exe 5 2->11         started        process3 file4 31 C:\Users\user\AppData\...\xTXuqPdjAiGmQt.exe, PE32 7->31 dropped 33 C:\...\xTXuqPdjAiGmQt.exe:Zone.Identifier, ASCII 7->33 dropped 35 C:\Users\user\AppData\Local\...\tmp113C.tmp, XML 7->35 dropped 37 C:\Users\user\...\VESSEL_DETAILS.exe.log, ASCII 7->37 dropped 57 May check the online IP address of the machine 7->57 59 Uses schtasks.exe or at.exe to add and modify task schedules 7->59 61 Adds a directory exclusion to Windows Defender 7->61 13 VESSEL_DETAILS.exe 15 2 7->13         started        17 powershell.exe 21 7->17         started        19 schtasks.exe 1 7->19         started        63 Multi AV Scanner detection for dropped file 11->63 65 Machine Learning detection for dropped file 11->65 21 xTXuqPdjAiGmQt.exe 14 2 11->21         started        23 schtasks.exe 1 11->23         started        signatures5 process6 dnsIp7 39 checkip.dyndns.com 132.226.247.73, 49697, 80 UTMEMUS United States 13->39 41 checkip.dyndns.org 13->41 43 api.telegram.org 149.154.167.220, 443, 49698, 49700 TELEGRAMRU United Kingdom 13->43 25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        45 193.122.6.168, 49699, 80 ORACLE-BMC-31898US United States 21->45 47 checkip.dyndns.org 21->47 67 Tries to steal Mail credentials (via file / registry access) 21->67 69 Tries to harvest and steal browser information (history, passwords, etc) 21->69 29 conhost.exe 23->29         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-02 09:24:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgnnevkdiqqw2gjis2srou3imlbegxyfigblxdsgr5w5t4k7hyzq._file
Verdict:
malicious
Similar samples:
1404d60fc92ad4f5e3059a37a50bc70803f25404635f969333b4618b891e64bb
SnakeKeylogger
26309e8127d86579dd6ae130c52298039f110548d77182833c261f0b0f43a340
SnakeKeylogger
351c0e2125e4a520bbe97ba66e4596f6a95fe1f52e2fafb7baef5cc0034aeb19
SnakeKeylogger
4bad07a175eeba8f014690c8856ba9210c0b8165ea7ddb3162ae78ea774fa122
SnakeKeylogger
82a9b190644c8424e65714aaab0bfd3d60cf0c4f1e4baa0385f4942a08f4f6cc
SnakeKeylogger
886a8581f310f5d4244c1f263a9e2bbc2d759bcc8078351990bf7ab2f1c1e717
SnakeKeylogger
97b9854240d147393cc47a0a37bbca4bfaad2233f87d45da15784b9750321039
SnakeKeylogger
c45857bf418c526b5652d2efea575e9c396fd9f46402b48cae1315a59dc13837
SnakeKeylogger
dce7af2c2162f2fa2be0ca63706446e0b3c4bebdf1ae8791f22cb76ca7aa375c
SnakeKeylogger
e3d6bf1ce9fea9bd1248afa6e927a1d763a3e0e899be2f0c0c77d12de4870654
SnakeKeylogger
+ 5'059 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger family:stormkitty keylogger stealer
Link:
https://tria.ge/reports/230502-lc2m4aad48/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Snake Keylogger
Snake Keylogger payload
StormKitty
StormKitty payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5923227859:AAEYo__DCK9GpHPQHPaQXx_5mU4DPDQb_xs/sendMessage?chat_id=1965959123
Unpacked files
SH256 hash:
e94c47d5f7c6c5789eb1f1d5330ad36bc8c35721a80921965751c93eb7760229
MD5 hash:
9570af6f4e9fb2afbe0077b62436188e
SHA1 hash:
e70fd893b4771277d43875e5d58a1ae8e4639651
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/319185c0-4b3e-4b82-a69f-fccf67783ed5/
Parent samples :
799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33
ab463de3b695c5e6a4f163c156ad7ef4949a728481711627de738b6a9d84d1f3
88725bfd871070e2e66b0b37295aff45eca79d8063dedf85973f8774210f2e71
d18cf7fcde053ba33105a836de182859fbfc493eb5185bbaddee1133b9063509
20fb89955cb329bf5597f90a7510f92a33ab31d05c21e1374a52e89dde377a91
3db10778e1d0ccc415a6ad057180e3ef8025d2f9ccfa77a14f37369189526955
9e5f01fcd9e6ad2a133b43fc012dd7f72fa09e87dbc8d5f98c2a6325e843affa
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
Link:
https://www.unpac.me/results/319185c0-4b3e-4b82-a69f-fccf67783ed5/
SH256 hash:
a665e68158b6aa7ca5338890d8671a83d5885a4b65d0efa66cecea8f7683db52
MD5 hash:
06841f0d240c40e876d00f05a3a2ef54
SHA1 hash:
8f3daf9f5c1f00759f7d65a8a33ab205cd61ec7e
Link:
https://www.unpac.me/results/319185c0-4b3e-4b82-a69f-fccf67783ed5/
SH256 hash:
998f8fd3481ed72c901ca668705960f3ecc30d82617ea8b54a6254e0625bba5a
MD5 hash:
de58e73b275ecab6383c71a6d1dd69ba
SHA1 hash:
837180116d8f671f2561b1ad90fa34adff9005ca
Link:
https://www.unpac.me/results/319185c0-4b3e-4b82-a69f-fccf67783ed5/
SH256 hash:
8362a107d309eb065d84b5780573c9fd37827ff8f975eaa758b6cec1091172fc
MD5 hash:
c23099f8f63823b69870bfbf7749ecef
SHA1 hash:
2651b69408237d6854e68fc610ea8bb12acae4fd
Link:
https://www.unpac.me/results/319185c0-4b3e-4b82-a69f-fccf67783ed5/
SH256 hash:
799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33
MD5 hash:
51bb2cd3a440b03b8f3395668bb7ed44
SHA1 hash:
de675a2e334b5d1c30f52184cb1b2c7c9e071656
Link:
https://www.unpac.me/results/319185c0-4b3e-4b82-a69f-fccf67783ed5/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/799ad2554344/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/386014/

Comments