MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7d302f9d3565d5968f1500d01a8e6ea2b8440a318858a24a6abbe24fbf5c2214. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 9
| SHA256 hash: | 7d302f9d3565d5968f1500d01a8e6ea2b8440a318858a24a6abbe24fbf5c2214 |
|---|---|
| SHA3-384 hash: | 65888270c42869bfa91bd747a219a85c98d3db7657abc197034acef2f207321602ddfb18f62a869ae46a0ce6947cbadb |
| SHA1 hash: | ef3ea23c0aa52e8a8576cca04e1b7007b7de5410 |
| MD5 hash: | ed70b8259457cd16738f1b4129599e68 |
| humanhash: | vermont-batman-zulu-oven |
| File name: | Proforma - Invoice.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 593'408 bytes |
| First seen: | 2022-07-04 07:27:54 UTC |
| Last seen: | 2022-07-04 08:58:50 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:2AxuXKXXMJj3HrAW5GwE9E1uOu1i3P0KCzxJSwQTjjMC5UNLj/:5C8XAj3Hp54j1i38KC/SwQTjjMC5gLj/ |
| Threatray | 5'598 similar samples on MalwareBazaar |
| TLSH | T199C4F15EFBF6CD12C35C1736C5D3442843B19842B22BDB2B3B8517E66B033A7994674A |
| TrID | 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  abuse_ch |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Status:
Malicious
First seen:
2022-07-04 07:28:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 26 (92.31%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 5'588 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
0305d31fba760f5f0f614f0148393420b6f93e7d045a5e1a66b36d253a61063f
MD5 hash:
a398d2702ea9eb85b8c399648074c57e
SHA1 hash:
e7069f06a35c87852e48483e548c0d7c063fc666
SH256 hash:
70bb4f8aa7d0a33f8206f78c845fa2bd686c2a0f2b3bd50cd0b6b887a45398ca
MD5 hash:
30d61a3a3e26c2bca2eb766990132d7c
SHA1 hash:
94f9742d5f21b13f7d8d194fe938193cbb6a0d4d
SH256 hash:
244273f79748fb848571ec03708a1d000b63b1aa07dbdeef1e992f4f5c3b4ff5
MD5 hash:
fe9160fd4496b31745922e0f5c8af580
SHA1 hash:
81c5a1910a0437b0b04b76f0623db995f0975ea0
SH256 hash:
3b59fe180dd50e3f3d4fdcbdd4e7a2d4e3e1c85ae43cb4f3716c4be41e9ec2ae
MD5 hash:
9ea556e333e216a65aa09c102f36004f
SHA1 hash:
814c07f1dc68bd61840384aac3aa8346d9f8148f
SH256 hash:
c40f318a2ac67897ab3063d52fbfd27a792a6f39623419430a5068880a48096c
MD5 hash:
cb71dc87c3b1b899b1ded3934d56175c
SHA1 hash:
68f48ec28cba9438f7dbf0448031e6986a101ce7
SH256 hash:
af1e75709a64ec28a999526ed86692933dcd78487430d08ea628019bb99786f5
MD5 hash:
3d216fe30135d17f50b5d7e006ac783b
SHA1 hash:
424540be48f805b06f8cca1388a7f616da32a102
SH256 hash:
7d302f9d3565d5968f1500d01a8e6ea2b8440a318858a24a6abbe24fbf5c2214
MD5 hash:
ed70b8259457cd16738f1b4129599e68
SHA1 hash:
ef3ea23c0aa52e8a8576cca04e1b7007b7de5410
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.