MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 16
| SHA256 hash: | 7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd |
|---|---|
| SHA3-384 hash: | 508b7be8e5f965f947fb11c74f8d36d183a8570388ce4af641e047b0976abeadd9f33b91f4401b1e8d2bc68fd7ad01b0 |
| SHA1 hash: | 4b047e307fa43eb5687325fc678141d9e47608d1 |
| MD5 hash: | cedd959b184eaba0ea42e673abeca334 |
| humanhash: | carpet-blossom-delaware-lamp |
| File name: | cedd959b184eaba0ea42e673abeca334 |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 768'000 bytes |
| First seen: | 2022-11-25 09:15:39 UTC |
| Last seen: | 2022-11-25 10:30:49 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:omGMYsZ1DX/VDJtV7JHoqG0ipusXGYtRwrhNCeHf5+23:o9MYk1In0iws2YPwrKeHR+Q |
| TLSH | T136F4D58B1FE30E84FB5E3670188FD7441ED3386148F49CA65A705AE729035BBD6922ED |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
579
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CUSTOM CLEARNCE FORM E.xls
Verdict:
Malicious activity
Analysis date:
2022-11-25 07:05:36 UTC
Tags:
macros opendir trojan exploit cve-2017-11882 loader evasion snake keylogger
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-11-23 19:46:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
28 of 40 (70.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
MD5 hash:
21246cfe0f90ff27085d76afa64244c2
SHA1 hash:
f76247ed2d0fdbd4496e3969cfcf6d457cc61fa1
Detections:
snake_keylogger
Parent samples :
0a2309336014e8ef72f8e8bcb41902b3c7e56f5c8afa477fda99b1e4f57bb852
0f6df37b515f330df516df24a8023025514d88fea9371ff96491003dffdc9b09
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
f0579298f475e4a98ec491ff10dc3bbab6ceac3b4f376a297ae03d36c177a09d
521e9db681ade0e368a3e99d735333c0d18df6087aa1f2fe6984c84ce1e4a1d8
a3465cca56d61a376078e6ac2d7466fae46bf7d073b9145b768f77ff33a3da0d
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
2afad9ad588a3219b1b36b0096ff4a8db8d70082fd09a612dc6f5935e46f0d4b
73237e3aa90060dbd999b15b39d48db44b63a5d23fd9b2c279fc97cd43a862fe
4832ccbb9379c4046a7478c3cba20a47cb978f37f11ace9afe0d8adb73e17003
9187704232908ac59df2c41f8129eb02fd895817abbce1c6d961a8024ebeb092
6fd62542f92cfcd09af0b2ad8f007a9dc110d64c16cfaab24a9ffd6552a754e8
178f92100449f71a893b39f99b0b3b434d54bd2b2833aaefeb0ab4415f7fb713
df757778956e59dda13ed21877d89a7b55902f285c5958d248300e2e9cfffb83
552b11b82396419c3efd98ecb70657b2d7652d061bbd5d626e478812a65925ee
7b3466885a3f5a38211cd4b6991a384b4a9d8747d5498f4762183e2a48a7fd23
ed31c7e7fc9f786ba9afc2d2885da4db73c4cef7c4514ce69089f57732f5b1ae
68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f
c8b129ddf3b6fbe3a7fe51c48706375b0a3c90711fdbb0111e215076bbfeef58
78f1957ff80044cf3cee3e4efbedbb55f3b64814ed8804fd076822d4ffcbcb6a
17c4cd880779f7dc3b48f6a2e097770b8b078fcc25f06286874233b3fbcb5099
3c78d5139a49e3f81272c1c7e7eae14f22ed3f7e89b8675663a574153d803eef
875ec0c37d9c973142c00da42bb1b6b6e58115cf85ba0e4e231d7bed7df3b21e
fc994ac728ca7b5d34d00f167b331c187110c45d4911572adc1eb279eb158b00
6381387fc80de027985e11c349120a3ee36724617ccbd2fb67b2d72663f8f93e
18743d67309b9042dccd7fc9b27dfdf6860b11745831d891fb64142836e3fc77
1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
585d258b90d3d045c1bd5e5858cc174a51bb25a425612934cd7f167e9a5029af
45ee7fd677dda19356451ef24de0d55b3ccdb5b54c47b5b053a1cf7a280736dc
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd
5bbeb09102c0876fc3d18a31c5aefdfc6f42a4354422611bfefedba2d51da208
cb252bdd63776400aa0f5b41de8ea075a2acb0ef25bcbcc430adb2d356b9e751
489ceb676e0e15e5e5c277ccb679b4508c7ac746e36ec21d4c7d9a52f8f1c88b
0f6df37b515f330df516df24a8023025514d88fea9371ff96491003dffdc9b09
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
f0579298f475e4a98ec491ff10dc3bbab6ceac3b4f376a297ae03d36c177a09d
521e9db681ade0e368a3e99d735333c0d18df6087aa1f2fe6984c84ce1e4a1d8
a3465cca56d61a376078e6ac2d7466fae46bf7d073b9145b768f77ff33a3da0d
25d396ebf0cb796a432bff994c74ea79e44b629584b98515eea9fb7b92019a4d
576aa02b24864b2430af14fbbb6958ff3689b783b7e91012ccb247af6c4a29f2
2afad9ad588a3219b1b36b0096ff4a8db8d70082fd09a612dc6f5935e46f0d4b
73237e3aa90060dbd999b15b39d48db44b63a5d23fd9b2c279fc97cd43a862fe
4832ccbb9379c4046a7478c3cba20a47cb978f37f11ace9afe0d8adb73e17003
9187704232908ac59df2c41f8129eb02fd895817abbce1c6d961a8024ebeb092
6fd62542f92cfcd09af0b2ad8f007a9dc110d64c16cfaab24a9ffd6552a754e8
178f92100449f71a893b39f99b0b3b434d54bd2b2833aaefeb0ab4415f7fb713
df757778956e59dda13ed21877d89a7b55902f285c5958d248300e2e9cfffb83
552b11b82396419c3efd98ecb70657b2d7652d061bbd5d626e478812a65925ee
7b3466885a3f5a38211cd4b6991a384b4a9d8747d5498f4762183e2a48a7fd23
ed31c7e7fc9f786ba9afc2d2885da4db73c4cef7c4514ce69089f57732f5b1ae
68869812f8a2684414348ecc16579fb740a8bfc179957641ee2c39db6ad271d1
397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f
c8b129ddf3b6fbe3a7fe51c48706375b0a3c90711fdbb0111e215076bbfeef58
78f1957ff80044cf3cee3e4efbedbb55f3b64814ed8804fd076822d4ffcbcb6a
17c4cd880779f7dc3b48f6a2e097770b8b078fcc25f06286874233b3fbcb5099
3c78d5139a49e3f81272c1c7e7eae14f22ed3f7e89b8675663a574153d803eef
875ec0c37d9c973142c00da42bb1b6b6e58115cf85ba0e4e231d7bed7df3b21e
fc994ac728ca7b5d34d00f167b331c187110c45d4911572adc1eb279eb158b00
6381387fc80de027985e11c349120a3ee36724617ccbd2fb67b2d72663f8f93e
18743d67309b9042dccd7fc9b27dfdf6860b11745831d891fb64142836e3fc77
1276d69291b917af55a996adf07d0157379b7afa227d51d2ff86d4e06311afed
585d258b90d3d045c1bd5e5858cc174a51bb25a425612934cd7f167e9a5029af
45ee7fd677dda19356451ef24de0d55b3ccdb5b54c47b5b053a1cf7a280736dc
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd
5bbeb09102c0876fc3d18a31c5aefdfc6f42a4354422611bfefedba2d51da208
cb252bdd63776400aa0f5b41de8ea075a2acb0ef25bcbcc430adb2d356b9e751
489ceb676e0e15e5e5c277ccb679b4508c7ac746e36ec21d4c7d9a52f8f1c88b
SH256 hash:
afa4cb1773a42f6cd3a492a7d4f453a25dde856abaca2dea628467a24b902fa5
MD5 hash:
02dcdae6a5b85f450f4b33850ce1f5d8
SHA1 hash:
c9cf14fbe2cd8d9509ff98ba72b3ff17d0e23c81
SH256 hash:
5e01cca557494f458d3a09235cc39129eb04d258e13e4ed1b971f660a8e17d46
MD5 hash:
f0e61bcb71f5a9fbdee394c37182c609
SHA1 hash:
4d6b0f06872d0582ede41ca017020f97fc21d981
SH256 hash:
cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4
MD5 hash:
aabd0bdc81026ade6c57383f21d5c227
SHA1 hash:
4b26936bb8c03be6d7963184215a5ab594ecb765
SH256 hash:
ab19f28c700d64814b0c55df868c30dfb94e0a1f9fb6f7bca05bac6eb78a4e52
MD5 hash:
1f2a6c02dcf9aa00a28a5039fb5b8ce0
SHA1 hash:
1ef480867d39b98368af7586a8e6ba38c0c3893a
SH256 hash:
7bbb472561d41124f3f71db30e605a89f15ce6b39f472130524149dc450c74cd
MD5 hash:
cedd959b184eaba0ea42e673abeca334
SHA1 hash:
4b047e307fa43eb5687325fc678141d9e47608d1
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://192.3.101.26/42/vbc.exe