MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9
SHA3-384 hash: 843cd75bb13551895187fb728f10d6c34e9a83b2cc11edf955b6569fb1e58d30331a962d2c1f0611bfc0e69f0f06639a
SHA1 hash: 7149fcfc067b91fa57186d3c0ed0c9056bb59842
MD5 hash: 849c47adca493169ca05d46b16912631
humanhash: fruit-london-indigo-bacon
File name:Quotation price list.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:772'096 bytes
First seen:2023-03-27 10:21:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:hA5CB0OqJhZrzJV665IHCzwdvkSCcr/+VQ7CSOqJ7KEk0Vr2IPeiBS8rBy:hA5aWDyaIic1nxGVQ7CTxEX4IG
Threatray 282 similar samples on MalwareBazaar
TLSH T1BCF4F145F3D96722E77B6BF069B08440E3BCB4E66B12D98D4D9A20C790F57008E53E6B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 6820f4ccd4d4e868 (11 x AgentTesla, 8 x SnakeKeylogger, 4 x Loki)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quotation price list.exe
Verdict:
Malicious activity
Analysis date:
2023-03-27 10:29:57 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/9786fd95-3ff9-4e15-a149-615fec475e79

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/377832/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker comodo darkkomet packed
Link:
https://www.filescan.io/uploads/64216e5423f92296f1f0cc2b/reports/4cd81fd7-83ee-4b06-8d3c-0c742427fed9/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/95410094-6209-47a4-8e24-3fc359801fd5
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1202578
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 835485 Sample: Quotation_price_list.exe Startdate: 27/03/2023 Architecture: WINDOWS Score: 100 42 checkip.dyndns.org 2->42 44 checkip.dyndns.com 2->44 52 Snort IDS alert for network traffic 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Sigma detected: Scheduled temp file as task from temp location 2->56 58 8 other signatures 2->58 8 Quotation_price_list.exe 7 2->8         started        12 wHikeiS.exe 5 2->12         started        signatures3 process4 file5 34 C:\Users\user\AppData\Roaming\wHikeiS.exe, PE32 8->34 dropped 36 C:\Users\user\...\wHikeiS.exe:Zone.Identifier, ASCII 8->36 dropped 38 C:\Users\user\AppData\Local\...\tmp99FC.tmp, XML 8->38 dropped 40 C:\Users\...\Quotation_price_list.exe.log, ASCII 8->40 dropped 60 May check the online IP address of the machine 8->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 8->62 64 Adds a directory exclusion to Windows Defender 8->64 14 Quotation_price_list.exe 15 2 8->14         started        18 powershell.exe 21 8->18         started        20 schtasks.exe 1 8->20         started        66 Multi AV Scanner detection for dropped file 12->66 68 Machine Learning detection for dropped file 12->68 70 Injects a PE file into a foreign processes 12->70 22 wHikeiS.exe 14 2 12->22         started        24 schtasks.exe 1 12->24         started        26 wHikeiS.exe 12->26         started        signatures6 process7 dnsIp8 46 checkip.dyndns.com 132.226.247.73, 49701, 49702, 80 UTMEMUS United States 14->46 48 checkip.dyndns.org 14->48 28 conhost.exe 18->28         started        30 conhost.exe 20->30         started        50 checkip.dyndns.org 22->50 72 Tries to steal Mail credentials (via file / registry access) 22->72 74 Tries to harvest and steal ftp login credentials 22->74 76 Tries to harvest and steal browser information (history, passwords, etc) 22->76 32 conhost.exe 24->32         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-03-27 02:22:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvfvtksyii3udaibqz7imamnbygd5csyqainrteprbiom22seg4q._file
Verdict:
malicious
Similar samples:
10c31b0a152c71ab736a8b867e081dfcbebaf8b9e00e342e10d06fe9cc5c0ab1
SnakeKeylogger
2b781ae6ff39d255f2e608de9ac6519a7644df12f13f574aa8caafa0123927a3
SnakeKeylogger
452a0f1b924d0aa8d7bb37f6c56cab6a2f20a4231d5d54ca71ffae1ce635300b
SnakeKeylogger
4ab665d75bc525a7bb5cffb01c28943b70fb3d4c7aceaf8a9a1bdbf1f0c7277a
SnakeKeylogger
571a662f9f434bfede9e6c79294bfd87fa23e7f93918e4824590b961f5b10d85
SnakeKeylogger
5950b1a61395119d915e3f08dc3bd0ea19b7aa186b13523351e73579e44c9d19
SnakeKeylogger
777e815415d8a5c55a3ddf78e28d4a50a5517f3938219c197c6e7c60a2f256a1
SnakeKeylogger
7ce6cf0e5a6d6633a5a6aef7d6ae9fe05e4ee2fffe4e7d4a2e5f7cf2562b07a1
SnakeKeylogger
ef211bfaef853190e1ff6800d966d09bd859b5c67ab738cb7399ab08a1f9ed10
SnakeKeylogger
+ 272 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230327-md9wjach82/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
42a1b13fcfeac3b9171c33a5f5d5cd202e022653fd40a3d77ec0ecffbdb25805
MD5 hash:
aca804d5d77bd73228eaa44a95402330
SHA1 hash:
fab4900d6af18796b65e1ab8f5ca4da5c933185b
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/7b596339-6093-4b2e-8f75-de00b41a592b/
Parent samples :
854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9
003c6607c3deee0f0c458c18220403e1eb2ae5469814756e551faf5bf3fc9f5a
e6c74fa34990259423123de4dca4a6b1924929ac74b4e0078c702ca2ec05782b
e7549401654dedc2a2064ccaaf8301c753c76b0f71f208c0d819f2a56ab8949f
ca598fdf9fb15e2c04dbb11f4c4ba49c397029ed14fe2eedbc5c320eea4a00a6
145b8aff160e3a50b8b5b9e6fd3b68106c1f3c0766bf76fa88faea0787d07bf5
8f90611a7d29f7e832d55fe1587107d30c53c2f580c45ea09c4f0cf45fe7cc7d
42a1b13fcfeac3b9171c33a5f5d5cd202e022653fd40a3d77ec0ecffbdb25805
3ace1af5dc3cf09c40ae8d4c0c4f499fbe1996c7c041ee07e30fb24283b4343f
SH256 hash:
e91931da57f7a51730d31bb15f1ab17269737b72c3f2632d3333bff164c063e4
MD5 hash:
a5ca23dd32eccb9874d0618ba17cb0d4
SHA1 hash:
d96bafa058e3b17f3814ee7bbe4194f795fe9d0b
Link:
https://www.unpac.me/results/7b596339-6093-4b2e-8f75-de00b41a592b/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/7b596339-6093-4b2e-8f75-de00b41a592b/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
7a5f87077b79d3cf8390b160211366cc5d0108a429a24573efad5895b511a42f
MD5 hash:
1591c5b837005efddbbb03c45e9fe21d
SHA1 hash:
73e6c8d3dd71416ca6daf7a56995d7f0f8f3f9dc
Link:
https://www.unpac.me/results/7b596339-6093-4b2e-8f75-de00b41a592b/
SH256 hash:
6bf9d07d639521837124af321555cbcdc5997fead136195aed97e2744e4120b6
MD5 hash:
acfbc6c59006cabeaa982c5cf3b2975c
SHA1 hash:
03ef87ee97fb810723f8cf284c09755c08822eb0
Link:
https://www.unpac.me/results/7b596339-6093-4b2e-8f75-de00b41a592b/
SH256 hash:
854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9
MD5 hash:
849c47adca493169ca05d46b16912631
SHA1 hash:
7149fcfc067b91fa57186d3c0ed0c9056bb59842
Link:
https://www.unpac.me/results/7b596339-6093-4b2e-8f75-de00b41a592b/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/854b59aa5842/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/377832/

Comments