MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7afedbcc82dc9c52b5c888493bb624e62d4d2acecc414c6d77cd3f306512b3a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7afedbcc82dc9c52b5c888493bb624e62d4d2acecc414c6d77cd3f306512b3a3
SHA3-384 hash: 33df02f12a430fcf7c685aeb954b1f77aef1400df2c294be88751f284d94fd8ca4e98d3982c3a78fe01394aae2c5a42c
SHA1 hash: a17d2ac67f0592813d3c0df5a6c68739b0d2b095
MD5 hash: aadd1762bfb2453cb0003c164e5a0239
humanhash: alaska-whiskey-cola-spring
File name:Invoice-309-Ref-284.lzh
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:586'588 bytes
First seen:2021-08-17 19:45:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:H5ULeSAYa5RKSZfoV17Y+ue3LE9zDANYg3VkOjL8WPWm8UKRo2rE3:HDSAnRKSoZXulzMW+temnOoKE3
TLSH T195C423B735B8B02BD6050060D185CBBC98120F7C97FB52DB86ACBAC65C93E16F8D9D42
Reporter cocaman
Tags:INVOICE lzh rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "bellchem <cnbellchem@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [185.222.58.146]) "
Date: "17 Aug 2021 18:06:16 +0200"
Subject: "Re: Proforma Invoice-309-Ref-284"
Attachment: "Invoice-309-Ref-284.lzh"

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7afedbcc82dc9c52b5c888493bb624e62d4d2acecc414c6d77cd3f306512b3a3/
Threat name:
ByteCode-MSIL.Spyware.Snakkel
Create hunting rule
Status:
Malicious
First seen:
2021-08-17 16:25:30 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
15 of 28 (53.57%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pl7nxtec3soffnoirbetxnre4ywu2kwozrauy3lxzu7tazisworq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210817-vrs2dy94ys/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/7afedbcc82dc9c52b5c888493bb624e62d4d2acecc414c6d77cd3f306512b3a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 7afedbcc82dc9c52b5c888493bb624e62d4d2acecc414c6d77cd3f306512b3a3

(this sample)

SnakeKeylogger

Executable exe f77e4fa75a8fe4af5b59b5c85ba46fa54b7ae232b410899aaee610a7e3f643d8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f77e4fa75a8fe4af5b59b5c85ba46fa54b7ae232b410899aaee610a7e3f643d8

Comments