MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db
SHA3-384 hash: 75c8aa7fc3a415fadc78e4ad9f24cbb1cc0082bd7341f4bd16f2ef7b44d7b3a7befe4a50f41082586bbf3d578f3c5f27
SHA1 hash: 76590a09e93ee2d794afb7e8a62566a69076963c
MD5 hash: c50e79fa060999c78a00eb4ee6f7013f
humanhash: berlin-golf-carolina-video
File name:INVOICE.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'012'224 bytes
First seen:2022-12-23 04:07:57 UTC
Last seen:2022-12-23 05:37:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:h1LYacIIm+f+849ns7MpW6kcEgVsTuZvHpIqEMPqqG3jx3H8cAPy+7f+mDXttarx:zLY9IIPqs7MpBU0ooHiq4zxo
Threatray 10'609 similar samples on MalwareBazaar
TLSH T14525C4ABD9A82223D071D17697E31B2AF481F007F4825F1D4FCB9F3665916C22987A1F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f08f898c8e8a8fb0 (37 x SnakeKeylogger, 19 x AgentTesla, 17 x AveMariaRAT)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INVOICE.exe
Verdict:
Malicious activity
Analysis date:
2022-12-23 04:10:58 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/cc997cf9-ff81-4d84-99db-a52e95f1a736

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.64433721.2205.24456.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63a529b132185f3aef0dc87e/reports/a893e802-4ec2-4d8b-a6c8-4ee2185becaf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ce2d81b-4614-4802-966d-33bd4fc940d5
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1139776
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2022-12-21 21:22:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
18 of 39 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpbq36hf56vqbnnfkmwwyzf5rzhtrevjuxcw4y7tymxoydjt7hnq._file
Verdict:
malicious
Similar samples:
11be9de3f678eaaca2d49fddd0fd21647f75ed6bc683b9216638204e9a0ac1b4
SnakeKeylogger
364d0bdf248f7f0e275ccbf178e50e55cf76b13ec131a0f2156f20526ef24991
SnakeKeylogger
495c80adad64f20ab292f42de22850ba2abcc8f9a1c1eb41eda64088fd0bfaa8
SnakeKeylogger
4bb9d6b2fd689b24941493f61b6c39313a35fe7e544a686b69e5a21f38db511c
SnakeKeylogger
757bbc65cd11c88a4b5852e131522b2dfd2a2ada73b14c49065e2da7f8ce14f4
SnakeKeylogger
7f97d04098391576cb56d494a5e59eae649155a4ba10cf490a8d30fa24d3eb93
SnakeKeylogger
9c0cab2fc38f52243eff7e3fa43e088d76b0a77d1253230c0d9b28c8f64f611d
SnakeKeylogger
b5976eb47b7ee86e14820c9ec28dfda460cefbcbcf9936c711512b9fd5260c10
SnakeKeylogger
b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce
SnakeKeylogger
+ 10'599 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221223-ep9qxaah8w/
Behaviour
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
fc6485350cf55dc14ecbfd9b91b7a9979f61023b4104101e9f351caa6c73abaa
MD5 hash:
6c3fdb2b5d93cf814ea1b6ca05a0efcf
SHA1 hash:
f8ae5f9fa1c9b6b0e47b2f0873d2ee3373e0ebf5
Link:
https://www.unpac.me/results/94fe8de8-6d5f-4fe2-b7e0-a1ab1e419855/
SH256 hash:
4468d526e6dd43c57c51a77403f9bcc536cbeabaf5017f52f7eea2200276951e
MD5 hash:
d83341fb5ec8ab2ff744f607f26fed14
SHA1 hash:
acf3de133d0d60b17cbb0e2f7f1bec602fd03571
Link:
https://www.unpac.me/results/94fe8de8-6d5f-4fe2-b7e0-a1ab1e419855/
SH256 hash:
1123cc9c6bc191625200ac0f1bb3c26c063daf0c0c3e6fa6d7c89508fcbdf38e
MD5 hash:
1b267fc4bf7cd79850b9cc51885157be
SHA1 hash:
a385e64264daf26553406a6c553caea56f8b8e24
Link:
https://www.unpac.me/results/94fe8de8-6d5f-4fe2-b7e0-a1ab1e419855/
SH256 hash:
67831417a9445ecc579ac1802f76cfe1a1c813f663ddbdbc7c21926a2210d9d0
MD5 hash:
82d7a0830f7941903acd1df67ae10280
SHA1 hash:
906947993281a8ae16285d4f2dc2f52dab024d07
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/94fe8de8-6d5f-4fe2-b7e0-a1ab1e419855/
Parent samples :
b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce
b5976eb47b7ee86e14820c9ec28dfda460cefbcbcf9936c711512b9fd5260c10
ac74957ffebda2f33603be3668eab0eaeb0deb26874cc2f6f877ef0e2c85cd79
f149ad4d9fc4f3d0dc4cba5a0d1419ad81dc0fd37b179c5bff458ea3666a4c6c
062d1412e5065ad96e3bedcc9a721caf0b2744dde92edd16820c66b8f8679856
725a65de7a17d632eb35dc3e80e1464b1f279218d765cea8f4502c51b6798874
83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db
4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc
eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116
811776b7e88a6f52c43527f71c90981244e6cde742fe45a88c50b15327f5406b
fac6a7623bd40a11274201b5ea609d276e8fd43d82eff03e3136997dbe54c19e
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
Link:
https://www.unpac.me/results/94fe8de8-6d5f-4fe2-b7e0-a1ab1e419855/
SH256 hash:
83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db
MD5 hash:
c50e79fa060999c78a00eb4ee6f7013f
SHA1 hash:
76590a09e93ee2d794afb7e8a62566a69076963c
Link:
https://www.unpac.me/results/94fe8de8-6d5f-4fe2-b7e0-a1ab1e419855/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/83c30df8e5ef/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments