MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5
SHA3-384 hash: 07bdc5c5eb1705806fbfffebead618eb643c6c3c3bfbada712a7def7e684650a298f835ed632b4310e27fd5ddf57e00d
SHA1 hash: 8bd872b4b8d9f03ad26ed7c8af2993d2780dfb4b
MD5 hash: 6215c21244930ce9ada085fa2b057a5b
humanhash: six-arizona-salami-south
File name:MV TBN.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:753'152 bytes
First seen:2023-03-27 13:33:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:l2y/EHTNu6DQlI9ZE0ml3iOpttWsYXePKUU6aeU0Kmt89Zwd8:l2TXUhZiOttW7MIVfZG8
Threatray 502 similar samples on MalwareBazaar
TLSH T1DAF4E001CD7A5E35F8E5D3B41160173A07A8B7A12472E2098BFA68DA3DDBF6305E194F
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter James_inthe_box
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MV TBN.exe
Verdict:
Malicious activity
Analysis date:
2023-03-27 13:33:27 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/c18feaf8-9018-4518-a31b-b8323e8a4ea2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/377909/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64219b4cfa73f9cb0d60113a/reports/808e46b7-eb37-4b33-b272-ac843460c953/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d351bd60-401a-4d93-a4dc-59e0fc4b6834
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1202729
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-25 00:23:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pox2sqmdtktex3uooxqc22fyadinz5prt6mb5ls6vxs3thlfpxsq._file
Verdict:
malicious
Similar samples:
02ee87012effdfa84c909b301c1c997f5ed0489c72f5cc3aa90acb9271ca9283
SnakeKeylogger
33497120ede69ba4d6c9c7bb4533ec7ece887acfa9ed2d617a215ff81126b46e
SnakeKeylogger
385b0dc759da9aa986880e3652447db19686c359b11b27efac77200c2e48544f
SnakeKeylogger
84df116f1326ab65e4c91ec9c243e4e2b819c19dc2e47f1e10878a52f96c4c41
SnakeKeylogger
89f3250563d9548740f1682f4f79b7b515e8af4e09a63a868ea53cf59cb90f1a
SnakeKeylogger
8c92fe975db6f552f522fbd9a8e542ae2e78cc0c21bb5e316b883b23e0084038
SnakeKeylogger
d0a101d03dba528a94c83f78c965018dee7fbc198ebfa5c251ad788672b7a127
SnakeKeylogger
e7f3e64f094d2952506148c2b0d6062a73999fb26a2eac49e6698515e3c2156e
SnakeKeylogger
f3f560dddb5b80bbe688cc8bae8f2160f91b8bb494a9795246af42d7b2d19b2b
SnakeKeylogger
+ 492 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230327-qtks5adf59/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
3f91e0c77ba79255e66919c42e07444a0073f3ba5c8072973186a27323b05433
MD5 hash:
39d52b9e2c77c97ee92a71bfb8c19df6
SHA1 hash:
fe8eb51190585be445841971180217f9b1b15047
Link:
https://www.unpac.me/results/cd45a13d-77a0-41be-aa20-7b0df33b6ab9/
SH256 hash:
bbc917756d618e9261c13be81de39ee663492964f6b86c3bf6b4c1f0c9b9b7fa
MD5 hash:
ed16707a8fdfec3916273726279cf3ce
SHA1 hash:
de6cc2cf8c7bde981db84c4b141a4330d79a7641
Link:
https://www.unpac.me/results/cd45a13d-77a0-41be-aa20-7b0df33b6ab9/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/cd45a13d-77a0-41be-aa20-7b0df33b6ab9/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
cde0d3400cd787fce5d1b95fa52908d64831430cc90dafddbaa79ae0d03bb3d0
MD5 hash:
06a5bc1d3143bcac174d81c5ffc09def
SHA1 hash:
650fb4549fb98ee4c7be5e03bf670241e6339cd0
Link:
https://www.unpac.me/results/cd45a13d-77a0-41be-aa20-7b0df33b6ab9/
SH256 hash:
107ba93185dc402a18a186ad6274de306af39e8567422b69899e389bdd59dc07
MD5 hash:
ce64eadf9377bdde1bcdb5a418cdba2e
SHA1 hash:
02f07ddee9d8dc300e53b77494227fb0ce6c217e
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/cd45a13d-77a0-41be-aa20-7b0df33b6ab9/
Parent samples :
1ad7b8905cf3a9751a24627a7cf9f063cc42c4608962a144a87ff2023c41f08f
579bd1dd91f69d5b162efb890ee512dab4c4782abd9ed92bb1ac46a28bd0da81
425784ee1fee47e2a2c176c481717b514ecb91b401ad2975bf398e0b6f42636f
774bb1005f6ac7bf88ecf01608d08c6dec144b0a4545ce3ebd46c711e17568af
7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5
SH256 hash:
7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5
MD5 hash:
6215c21244930ce9ada085fa2b057a5b
SHA1 hash:
8bd872b4b8d9f03ad26ed7c8af2993d2780dfb4b
Link:
https://www.unpac.me/results/cd45a13d-77a0-41be-aa20-7b0df33b6ab9/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7bafa941839a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/377909/

Comments