MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86eefb61308feb54cd1933852bef9e6f42f000c0cfab9640673ad924c3b38c6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86eefb61308feb54cd1933852bef9e6f42f000c0cfab9640673ad924c3b38c6f
SHA3-384 hash: 59d8d6a1ff3981c468567f13f3b0cd686abbcf89641a57fc5ffaf6d812951bd94ac58c099597f368d5e0c7d2017b219e
SHA1 hash: dbdbd91eb5a0790bdaf440874b627bf310e30e13
MD5 hash: b23bf8d8f795c3bc5baf8a3fc35069b6
humanhash: west-grey-saturn-diet
File name:Revised_quote.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:936'960 bytes
First seen:2022-07-11 08:09:32 UTC
Last seen:2022-07-11 08:51:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:RR05WSuGZzwULC/C1561xkTyROWwbTIkd2LDZAOxArtvygo2Ys:7QcAMUC/CfuwCanrtygrYs
Threatray 4'908 similar samples on MalwareBazaar
TLSH T1E415CFCBA064DA50F125353C31BEE39052B1AC7A859CFEDFB86E3C3D09F45A6241A5C6
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 31b094969698b033 (3 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Revised_quote.pdf.exe
Verdict:
Malicious activity
Analysis date:
2022-07-11 22:47:40 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/481d99c0-2ec3-404a-9f68-b0618625b7b5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/286014/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.24195.17017.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62cbdb1922051a09ca713deb/reports/077869b7-72bb-418f-aa56-b2af7a1be3c6/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b6ad51de-823b-49a2-abac-ed882837c204
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1029020
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 661514 Sample: Revised_quote.pdf.exe Startdate: 11/07/2022 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for dropped file 2->42 44 12 other signatures 2->44 7 Revised_quote.pdf.exe 7 2->7         started        process3 dnsIp4 32 192.168.2.1 unknown unknown 7->32 24 C:\Users\user\AppData\Roaming\jAUvYua.exe, PE32 7->24 dropped 26 C:\Users\user\...\jAUvYua.exe:Zone.Identifier, ASCII 7->26 dropped 28 C:\Users\user\AppData\Local\...\tmp68A6.tmp, XML 7->28 dropped 30 C:\Users\user\...\Revised_quote.pdf.exe.log, ASCII 7->30 dropped 46 May check the online IP address of the machine 7->46 48 Uses schtasks.exe or at.exe to add and modify task schedules 7->48 50 Adds a directory exclusion to Windows Defender 7->50 52 Injects a PE file into a foreign processes 7->52 12 Revised_quote.pdf.exe 15 2 7->12         started        16 powershell.exe 25 7->16         started        18 schtasks.exe 1 7->18         started        file5 signatures6 process7 dnsIp8 34 checkip.dyndns.com 132.226.8.169, 49755, 80 UTMEMUS United States 12->34 36 checkip.dyndns.org 12->36 54 Tries to steal Mail credentials (via file / registry access) 12->54 56 Tries to harvest and steal ftp login credentials 12->56 58 Tries to harvest and steal browser information (history, passwords, etc) 12->58 20 conhost.exe 16->20         started        22 conhost.exe 18->22         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86eefb61308feb54cd1933852bef9e6f42f000c0cfab9640673ad924c3b38c6f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 08:10:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3xpwyjqr7vvjtizgocsx346n5bpaagaz6vzmqdhhlmsjq5trrxq._file
Verdict:
malicious
Similar samples:
04901f5238094d47c17a1edbf3b945bf68c8dc9d9e2f5b1b7d24eac54812e063
SnakeKeylogger
0e2f39cdfe57c0086f2affcfbe3801ebb46938b47a6d73ffe98f734632fd7ed8
SnakeKeylogger
6fccc54b1735e68508ccfdad83f18a26226257c153b714d8cff7d0cffe905423
SnakeKeylogger
8399cf97a24ffed931ae3b24203ff6af69027c5d5651a31b11ccd51840b1a113
SnakeKeylogger
b9527b57b9fbb1b67da0530770e98dc15300f800c1cccd52c63de55692d693ee
SnakeKeylogger
c439e1f935661386e7fae6bb2716af4db1ad9d44cd874d40d22483292d2f6b5c
SnakeKeylogger
c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825
SnakeKeylogger
d90649023e828580e01a50d34142fbeb7495d5c7f9ccbe813183055c5c15885b
SnakeKeylogger
dbdf95efcfba65bef51e2ffaaaf83c908158eacc1e42967841d68ad2ab6bbf26
SnakeKeylogger
+ 4'898 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220711-j2pcysfdal/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5583198829:AAHbRGAnlJ9Tg3ETPxGtj_jZ8tVhm4DB4io/sendMessage?chat_id=1148000519
Unpacked files
SH256 hash:
0fae1855c65d635d55e5f6aa450d8c9f3bd63c5cb4ef8e7d6947757b6c4a812e
MD5 hash:
51b3e4f94acfd5f6febdeda4f4e09db3
SHA1 hash:
c526c72601e747287c80aebb4357e6091aa2a960
Link:
https://www.unpac.me/results/babf0819-9d90-404c-8dba-2bbaa544900c/
SH256 hash:
0503200ab2803a6796253c87d26dab9e20add08a15d82ba3d881e00e5f69978a
MD5 hash:
c570eca78d7931d86e24b4eb8a295bc2
SHA1 hash:
a08e447223e0aa4aa2ee1bfef98b13846d928464
Link:
https://www.unpac.me/results/babf0819-9d90-404c-8dba-2bbaa544900c/
SH256 hash:
86eefb61308feb54cd1933852bef9e6f42f000c0cfab9640673ad924c3b38c6f
MD5 hash:
b23bf8d8f795c3bc5baf8a3fc35069b6
SHA1 hash:
dbdbd91eb5a0790bdaf440874b627bf310e30e13
Link:
https://www.unpac.me/results/babf0819-9d90-404c-8dba-2bbaa544900c/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/86eefb61308f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86eefb61308feb54cd1933852bef9e6f42f000c0cfab9640673ad924c3b38c6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/286014/

Comments