MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86505875cc0ff8433accfde666c6b6971efe12d750a599a85efc38c0066cf845. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	86505875cc0ff8433accfde666c6b6971efe12d750a599a85efc38c0066cf845
SHA3-384 hash:	6e0c467c1f6cc90a78920262058d8912c4f58ef4689689f3c6dc80a83672de6c32080ab28334fe8ed1e68b2b6601b04a
SHA1 hash:	09883103097e4be7453bb32987191f7fdd76d0ba
MD5 hash:	551778a1583222e984178592f1e53085
humanhash:	march-juliet-triple-mississippi
File name:	OFFER ON SPARE PARTS (NO 000236765453553667.gz
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	567'411 bytes
First seen:	2023-01-26 08:43:07 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	12288:PdfDNgc+KDM0dlEKku8mRhJI2FIw6QwL1v70qnDkWr6077ppj3PrCpS6E:Fbh+KY0dlEW8mRhJI2lCzhFx/ubE
TLSH	T16FC423BFD6132D4E1FC2008A9273949E36EC1687AB95F1921E852081DBDBDB79075B28
Reporter	cocaman
Tags:	gz SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: ""Jermy Baccay Lasam" <jermy@mtcdubai.com>" (likely spoofed)
Received: "from mtcdubai.com (unknown [185.225.74.81]) "
Date: "26 Jan 2023 09:42:02 +0100"
Subject: "OFFER GLKDD 9636228"
Attachment: "OFFER ON SPARE PARTS (NO 000236765453553667.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

119

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	OFFER ON SPARE PARTS (NO 000236765453553667.exe
File size:	867'328 bytes
SHA256 hash:	876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0
MD5 hash:	d272d25b3efc69af38bd135d4e140e16
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63d23d53696b2d9725747b1f/reports/cff99926-9f50-4b49-9f79-6e3dca4bd888/overview

Result

Verdict:

UNKNOWN

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/86505875cc0ff8433accfde666c6b6971efe12d750a599a85efc38c0066cf845/

Threat name:

Win32.Trojan.Pwsx

Status:

Malicious

First seen:

2023-01-26 08:44:06 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

3 of 39 (7.69%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qzifq5omb74egowm7xtgnrvws4pp4ewxkcsztkc67q4mabtm7bcq._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/230126-kw59ysdb64/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/86505875cc0ff8433accfde666c6b6971efe12d750a599a85efc38c0066cf845

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.