MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a67b150e39e9a9e879083da6aba720773e8bd4b3a46729fff3a38554d27e05e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 12

Intelligence 12 IOCs YARA 3 File information Comments 1

SHA256 hash:	7a67b150e39e9a9e879083da6aba720773e8bd4b3a46729fff3a38554d27e05e
SHA3-384 hash:	dabdcf373c480acbad0a1e5acc5096f815db1987d7ac078cb5b5c3582952aa473d4c541318a3f5f80d4b68612539f070
SHA1 hash:	9d5295874a6d5bce167fe43c02b79dde88100ad2
MD5 hash:	0d01b398c62a9309102e4ff06a8e41ca
humanhash:	maryland-venus-yankee-london
File name:	0d01b398c62a9309102e4ff06a8e41ca
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	925'696 bytes
First seen:	2022-10-03 06:30:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	12288:qBx6K4HTN4C+IXBUZBjf4UZjXPzyUwRLee3fPDzWa2tTGH+Z0OfxM:NBkBjRZrPOUo1vbsty2G
Threatray	5'409 similar samples on MalwareBazaar
TLSH	T1F715BF2103E59B0AD0626374CCE2C3705FAB5E54E671C24B4FDDBC9BBB77296A610362
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.3% (.SCR) Windows screen saver (13101/52/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	cc9eb286beb296cc (7 x Loki, 6 x SnakeKeylogger, 5 x AgentTesla)
Reporter	zbetcheckin
Tags:	32 exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

227

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/315915/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.44474.26553.19773.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file

Verdict:

No Threat

Threat level:

2/10

Confidence:

60%

Tags:

packed

Link:

https://www.filescan.io/uploads/633a81a7dace43a378f41943/reports/2df45cdf-55b2-4966-87e7-f59251109e43/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a0cef94e-cabd-4ec1-baae-9f3292f2a5be

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1082160

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a67b150e39e9a9e879083da6aba720773e8bd4b3a46729fff3a38554d27e05e/

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2022-10-03 06:31:10 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pjt3cuhdt2nj5b4qqpngvotsa5z6rpklhjdhfh77hi4fktjh4bpa._file

Verdict:

malicious

SnakeKeylogger

009068479b9c2400314c9fda4e34b7706e1ef4d3adc7a8af096d32167cc44f08

SnakeKeylogger

2107eeec59919ea8ec495701134e942d7f88d19de70b97016f1df74b16c8c90d

SnakeKeylogger

2fc9bef4467f94362f4860fa9f501640b8a0964154fe5f2d8200f3d67b825b79

SnakeKeylogger

3b84b73506255cc004a7d907f244a6c4394adea87102125d1d5d44ea4857008b

SnakeKeylogger

61ceb9bb8363e17528ed811b0886a9aa174f5b26fe8e20cf9393d4d2d9df8041

SnakeKeylogger

73de38a06d84d51fd173c71af2ef473703a3cfe94792a4e3bc383c528b7b3192

SnakeKeylogger

bed584b2fd812270f30bffea36dec6db7a464f353f06bbf06252300e51ac4f76

SnakeKeylogger

c131080231441016343843fa5571d93831562b3e8e060ad645f3ce61e8635b01

SnakeKeylogger

ece5a8fb0e293999d5d0ead390604316ec94958f564294748c8154255d8247f8

SnakeKeylogger

+ 5'399 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/221003-g92l5sbea2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5996cb8b-8871-4fd3-9c33-4822a113d112

Unpacked files

SH256 hash:

25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d

MD5 hash:

21246cfe0f90ff27085d76afa64244c2

SHA1 hash:

f76247ed2d0fdbd4496e3969cfcf6d457cc61fa1

Link:

https://www.unpac.me/results/8ea80fb8-2d3c-4698-ad9c-746713d80ce3/

Parent samples :

0a2309336014e8ef72f8e8bcb41902b3c7e56f5c8afa477fda99b1e4f57bb852
0f6df37b515f330df516df24a8023025514d88fea9371ff96491003dffdc9b09
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
f0579298f475e4a98ec491ff10dc3bbab6ceac3b4f376a297ae03d36c177a09d
521e9db681ade0e368a3e99d735333c0d18df6087aa1f2fe6984c84ce1e4a1d8
a3465cca56d61a376078e6ac2d7466fae46bf7d073b9145b768f77ff33a3da0d
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
2afad9ad588a3219b1b36b0096ff4a8db8d70082fd09a612dc6f5935e46f0d4b
73237e3aa90060dbd999b15b39d48db44b63a5d23fd9b2c279fc97cd43a862fe
4832ccbb9379c4046a7478c3cba20a47cb978f37f11ace9afe0d8adb73e17003
9187704232908ac59df2c41f8129eb02fd895817abbce1c6d961a8024ebeb092
6fd62542f92cfcd09af0b2ad8f007a9dc110d64c16cfaab24a9ffd6552a754e8
178f92100449f71a893b39f99b0b3b434d54bd2b2833aaefeb0ab4415f7fb713
df757778956e59dda13ed21877d89a7b55902f285c5958d248300e2e9cfffb83
552b11b82396419c3efd98ecb70657b2d7652d061bbd5d626e478812a65925ee
7b3466885a3f5a38211cd4b6991a384b4a9d8747d5498f4762183e2a48a7fd23
ed31c7e7fc9f786ba9afc2d2885da4db73c4cef7c4514ce69089f57732f5b1ae
68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f
c8b129ddf3b6fbe3a7fe51c48706375b0a3c90711fdbb0111e215076bbfeef58
78f1957ff80044cf3cee3e4efbedbb55f3b64814ed8804fd076822d4ffcbcb6a
17c4cd880779f7dc3b48f6a2e097770b8b078fcc25f06286874233b3fbcb5099
3c78d5139a49e3f81272c1c7e7eae14f22ed3f7e89b8675663a574153d803eef
875ec0c37d9c973142c00da42bb1b6b6e58115cf85ba0e4e231d7bed7df3b21e
fc994ac728ca7b5d34d00f167b331c187110c45d4911572adc1eb279eb158b00
6381387fc80de027985e11c349120a3ee36724617ccbd2fb67b2d72663f8f93e
18743d67309b9042dccd7fc9b27dfdf6860b11745831d891fb64142836e3fc77
1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
585d258b90d3d045c1bd5e5858cc174a51bb25a425612934cd7f167e9a5029af
45ee7fd677dda19356451ef24de0d55b3ccdb5b54c47b5b053a1cf7a280736dc
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd
5bbeb09102c0876fc3d18a31c5aefdfc6f42a4354422611bfefedba2d51da208
cb252bdd63776400aa0f5b41de8ea075a2acb0ef25bcbcc430adb2d356b9e751
489ceb676e0e15e5e5c277ccb679b4508c7ac746e36ec21d4c7d9a52f8f1c88b

SH256 hash:

a04c799fa302c78d04acc3b4be8ccbde2f7fa00fe515daf18a2fc7e65fad3b13

MD5 hash:

d76812ec4cbc45e1e26ed36691596f7e

SHA1 hash:

c854fe9792694fb464a0bed51c737ff61ccef736

Link:

https://www.unpac.me/results/8ea80fb8-2d3c-4698-ad9c-746713d80ce3/

SH256 hash:

df9b1a9f8744e77a7114f8eb2d3c69e8bc0fdf398213eef3006b3ce8b3247225

MD5 hash:

b09abc57f311b7c201ddc92664cc03a7

SHA1 hash:

a65f52d7c1a8514613eddb16a2a851fd436bc634

Link:

https://www.unpac.me/results/8ea80fb8-2d3c-4698-ad9c-746713d80ce3/

SH256 hash:

cb6c1670702f9308ca5f0c9b5fae519dd295343b2e53dd2a880ee396ad919a95

MD5 hash:

33409656f25ea7bdeb488aa8b1fbb206

SHA1 hash:

45b7d938beda2e18f710541909a962f71e56a90d

Link:

https://www.unpac.me/results/8ea80fb8-2d3c-4698-ad9c-746713d80ce3/

SH256 hash:

e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee

MD5 hash:

35cb29046968faca7f3f3b4463449b6c

SHA1 hash:

088c8c30ec1bece0a4b5bbfe3982b073f8b95598

Link:

https://www.unpac.me/results/8ea80fb8-2d3c-4698-ad9c-746713d80ce3/

SH256 hash:

7a67b150e39e9a9e879083da6aba720773e8bd4b3a46729fff3a38554d27e05e

MD5 hash:

0d01b398c62a9309102e4ff06a8e41ca

SHA1 hash:

9d5295874a6d5bce167fe43c02b79dde88100ad2

Link:

https://www.unpac.me/results/8ea80fb8-2d3c-4698-ad9c-746713d80ce3/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7a67b150e39e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/7a67b150e39e9a9e879083da6aba720773e8bd4b3a46729fff3a38554d27e05e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

exe 7a67b150e39e9a9e879083da6aba720773e8bd4b3a46729fff3a38554d27e05e

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2345949/

Cape

https://www.capesandbox.com/analysis/315915/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-10-03 06:30:31 UTC

url : hxxp://107.172.206.118/uy7/gc8.exe