MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82fec44e43fc056ae43c3e9635f1ba3893b9b88f2a253fa08e7bd21f53b10303. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82fec44e43fc056ae43c3e9635f1ba3893b9b88f2a253fa08e7bd21f53b10303
SHA3-384 hash: b0bae3a7af4dbc63f2ad192325dd172e5250ad64230188bacf2a2e5af76dfe5360ff1a41da410d4e30da266c83f8792d
SHA1 hash: 999db0846941aaa8a814c592b89fd1e3b37a27bb
MD5 hash: 4ff894b79463d1b2ec17f56825dfce95
humanhash: chicken-early-mississippi-ten
File name:PO092121_xlsx.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:872'448 bytes
First seen:2021-09-21 19:11:31 UTC
Last seen:2021-09-21 20:09:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:/F6QTTQxJfEhREMvXOz/2l5VEnMs20hV8isHc/7VeGsEXWJCjXR9iEh:N6QQJ8vq/CsxhV8ilUGBXWJ8X3iEh
Threatray 1'073 similar samples on MalwareBazaar
TLSH T15505E0F25A026D5AFB650938BC05C5F00F565D4FC26045C8BFD92EBBB3EB6E08978960
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO092121_xlsx.exe
Verdict:
Malicious activity
Analysis date:
2021-09-21 19:14:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a96f08ac-6b4b-4060-9d45-8a104ab3782d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189959/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.24106.16705.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b8a098e5-0dba-432a-9dac-eae0062a8545
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/855146
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 487577 Sample: PO092121_xlsx.exe Startdate: 21/09/2021 Architecture: WINDOWS Score: 48 17 .NET source code contains potential unpacker 2->17 19 Machine Learning detection for sample 2->19 7 PO092121_xlsx.exe 3 2->7         started        process3 process4 9 powershell.exe 16 7->9         started        11 powershell.exe 17 7->11         started        process5 13 conhost.exe 9->13         started        15 conhost.exe 11->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82fec44e43fc056ae43c3e9635f1ba3893b9b88f2a253fa08e7bd21f53b10303/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-09-21 19:12:13 UTC
AV detection:
13 of 45 (28.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ql7mitsd7qcwvzb4h2ldl4n2hcj3toepfist7ieoppjb6u5rambq._file
Verdict:
malicious
Similar samples:
04514f416ce1d3bb390895ce496d91b024c3bd94cc3cb71ab6de2bcdb384e83a
SnakeKeylogger
080a67d131facb8ce1207b2f2ac65d336aa328903f88ed8498ca3c0090a95205
SnakeKeylogger
18ea5ebd8331a357b54d5ab5b08db0bce05f8c452cabca6ff56fa2264525de9f
SnakeKeylogger
28d365d0bf668ea41521237a106c5ad34b280ec1cbfc2b6a5d39ec82b72e3d2f
SnakeKeylogger
6970940c6f449a63ac5a04ad826be1f9236863ca76d040797bf2e8fbf89a6c3d
SnakeKeylogger
69e1e65f93b1939bf2677660efd59acec32e6f340134ea03f5c5abe17682c875
SnakeKeylogger
8072ca29a8527b0b1c1fa59ca07d85da4ce692ba73cc0471c73b47d08f839845
SnakeKeylogger
834833adf2996b1c2846f36b48aea5ec0b71fd7f14e314baacd3755d27825197
SnakeKeylogger
9cd3ef368ba18453043dc339a7666db5636655c58168ec64b59230be8635d741
SnakeKeylogger
d0fef103952fc6153a48b9d529d96d2f76cf989855877a16cc5aae393e1e3e0d
SnakeKeylogger
+ 1'063 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger persistence spyware stealer
Link:
https://tria.ge/reports/210921-xwhj4schhl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
4bb4d5ca12107da15329e8a6ce2703e364c29e6c9d9d35ffcc9f6ed239c7aa07
MD5 hash:
f908d6ccb250904550691e4e08970678
SHA1 hash:
c54add6536e3d2d8a2a12f3ff2109464c23e97dd
Link:
https://www.unpac.me/results/7897edcf-c435-45a9-a112-b624daa5cb6c/
SH256 hash:
82fec44e43fc056ae43c3e9635f1ba3893b9b88f2a253fa08e7bd21f53b10303
MD5 hash:
4ff894b79463d1b2ec17f56825dfce95
SHA1 hash:
999db0846941aaa8a814c592b89fd1e3b37a27bb
Link:
https://www.unpac.me/results/7897edcf-c435-45a9-a112-b624daa5cb6c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82fec44e43fc056ae43c3e9635f1ba3893b9b88f2a253fa08e7bd21f53b10303

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/189959/

Comments