MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d235a36d469dc104409fa44edb77a3d5a3d7217580f3350a10fb226d9f9ba3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments 1

SHA256 hash:	7d235a36d469dc104409fa44edb77a3d5a3d7217580f3350a10fb226d9f9ba3b
SHA3-384 hash:	61ab091e662d626726bb1676ef007d7ecd5f2d3313f46e39b3198267554d2ea6f1d07cc41307feb16599df71587ac5f1
SHA1 hash:	8dac01d4369fb75bc2a3d92dc352bcab010b8e57
MD5 hash:	230cdc5b9c916791dfe9124a499265a4
humanhash:	fifteen-video-early-nine
File name:	update order of attached items.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	498'976 bytes
First seen:	2021-04-21 06:05:03 UTC
Last seen:	2021-04-21 10:43:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ea4e67a31ace1a72683a99b80cf37830 (70 x Formbook, 64 x GuLoader, 54 x Loki)
ssdeep	12288:ua7vbKQq69o7ZsVhZitsQHwqNDHAUhZrbWEaeYa9B:u8+369o7Z0ZiVH7hxjbPFB
Threatray	513 similar samples on MalwareBazaar
TLSH	37B423096A51C9FBF13762320EA52B23CEFD89611891035B17A4777F7AB67D0285F2C2
Reporter	cocaman
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/141789/

Detection(s):

Sanesecurity.Rogue.0hr.20210421-0506.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Sending a UDP request

Unauthorized injection to a recently created process

Creating a window

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d235a36d469dc104409fa44edb77a3d5a3d7217580f3350a10fb226d9f9ba3b/

Threat name:

Win32.Trojan.Convagent

Status:

Malicious

First seen:

2021-04-20 23:10:40 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=purvunwunhobaraj7jco3n32hvnd24qxlahtgufbb6zcnwpzxi5q._file

Verdict:

malicious

SnakeKeylogger

49dfecc9b9d122b59de9c748c4c86308d6666a707bcdefa910cf9be7780b68bc

SnakeKeylogger

60b6d55beee9f47ef1e04a854c5e985ad5475b84a92e048432ceae4650a9e3e1

SnakeKeylogger

6f4fbab85c58d588450bc856ceff3894645e0033b4c4d2684184a8430c01daa4

SnakeKeylogger

89a173beec574576632b98017aee8549e88ec2673fd5c3028a74f5ba2d9613b0

SnakeKeylogger

8bcad4190aba21baa205b47acb1c22c1d473605036b5e32156dccc5d4ae52bc5

SnakeKeylogger

d273cc0da43feffe12b225bd5a7e5942d376296f74cae9fb942240a035e06c6a

SnakeKeylogger

dd44eb26a328f1e86823339666e1b1237ad7b1d880694c1b8fb8164b931aa512

SnakeKeylogger

e100812a13dcc0b92ee42371dd7b03f674581c41dc3a2c70109acff79333cf30

SnakeKeylogger

f9fa8cbd89dcc3d3126d537f9983b780af700ec94c1b5afb74d6b919c5854a02

SnakeKeylogger

+ 503 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/210421-nftkd8a3l2/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.67

Link:

https://yomi.yoroi.company/submissions/7d235a36d469dc104409fa44edb77a3d5a3d7217580f3350a10fb226d9f9ba3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

r00 a32bb58209626c22868278a90a0956495039289cf88d33d085419b9a8259266f

SnakeKeylogger

exe 7d235a36d469dc104409fa44edb77a3d5a3d7217580f3350a10fb226d9f9ba3b

(this sample)

Delivery method

Other

Dropped by

SHA256 a32bb58209626c22868278a90a0956495039289cf88d33d085419b9a8259266f

Cape

https://www.capesandbox.com/analysis/141789/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-21 07:23:48 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0032.001] Data Micro-objective::CRC32::Checksum
1) [C0026.002] Data Micro-objective::XOR::Encode Data
4) [C0045] File System Micro-objective::Copy File
5) [C0046] File System Micro-objective::Create Directory
6) [C0048] File System Micro-objective::Delete Directory
7) [C0047] File System Micro-objective::Delete File
8) [C0049] File System Micro-objective::Get File Attributes
9) [C0051] File System Micro-objective::Read File
10) [C0050] File System Micro-objective::Set File Attributes
11) [C0052] File System Micro-objective::Writes File
12) [E1510] Impact::Clipboard Modification
13) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
14) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
15) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
16) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
17) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
18) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
19) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
20) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
21) [C0017] Process Micro-objective::Create Process
22) [C0038] Process Micro-objective::Create Thread
23) [C0018] Process Micro-objective::Terminate Process