MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0
SHA3-384 hash: 3bd61d956f35ae2296bce3c425c738f6cf3a48c89a55ce27c2ee13edf88772c8b12ff135dba24c822a36f070a4caf9c4
SHA1 hash: b01a30bd868035db96beb9998b890be33b2eacad
MD5 hash: d272d25b3efc69af38bd135d4e140e16
humanhash: oven-video-purple-moon
File name:OFFER ON SPARE PARTS (NO 000236765453553667.gz.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:867'328 bytes
First seen:2023-01-26 08:43:13 UTC
Last seen:2023-01-27 07:16:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'633 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:4tG7vV5zxPCRgvZdVWoXDUFqIGWlcKcU8mxhJE2DYw6iwLT70EnFkoR60S4nqU46:AcWGWlcm8mxhJE23wJbqVWu2
Threatray 10'836 similar samples on MalwareBazaar
TLSH T18305AE1063E9DF86F9BD437AC274524067F37866A432D3895EE1A0FE1DB3B018A41B67
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 71e8e8cccce8e071 (8 x AgentTesla, 5 x SnakeKeylogger, 2 x Formbook)
Reporter cocaman
Tags:exe RFQ SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
OFFER ON SPARE PARTS (NO 000236765453553667.gz.exe
Verdict:
Malicious activity
Analysis date:
2023-01-26 08:49:03 UTC
Tags:
trojan snake keylogger evasion
Link:
https://app.any.run/tasks/d8f5d5e4-194c-4f8e-a442-5f840a83870f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/357042/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63d23d541c9cbf7d6252f356/reports/e05a20a2-ccb8-482c-b114-5e0ff8fdd562/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/74f81b36-4a11-44c1-b5e5-7e524bb76adb
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1159391
Signature
.NET source code references suspicious native API functions
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0/
Threat name:
ByteCode-MSIL.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2023-01-26 08:43:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
18 of 26 (69.23%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q5xwgn6fk3qgm4nd5gx3pxdkpmai747iqic5m4irvguj7d6d4cya._file
Verdict:
malicious
Similar samples:
4826ace8391d200aa066ceb967aad44fc540670826c59538aa0df039d2c2421c
SnakeKeylogger
4f5ea72df2ff98979013fbfe0781a01d8d487d886ebc5012e037f553527996d2
SnakeKeylogger
6a9d3a6f928c5a2a9ab9abe269027f3b987045fbb30803dd431ae2f56d5f859c
SnakeKeylogger
8572c3b461f643bf5baaeb032cf81f83af78dcc60e34d98c669d12f748bb38f3
SnakeKeylogger
8878359c93d36d0849467e895c724bd5a171a4ac97f29217aca79645f3c57a40
SnakeKeylogger
8fc56654c730505dd97bbe04e8c9f688b7b9366eb1981e848fe3c829a553f40d
SnakeKeylogger
d943f08a35dc06253557151dbff927a9eb4c26f425d328cf612cb7e5211c3822
SnakeKeylogger
ef208a2f463e7c3b8ea5c01332d60d691018a27fb0baf080fb2b42bad34b1d07
SnakeKeylogger
+ 10'826 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230126-km5xtsdb48/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
c191eed202149b83bc173ada9379f657db5ce6a6fc9e99eef61576f90e03886f
MD5 hash:
87ff8c4606bdfe92e2fcdea7b5c5c466
SHA1 hash:
e74bdf214f87b13fb986ebfa580065e9ec4acf18
Link:
https://www.unpac.me/results/dd6d6e77-9b00-4426-909c-5245958719dc/
SH256 hash:
54d781f0dee6692c47390edf1ada295fb17a7e80ed5ccd58ab14c6ddf80a0ad8
MD5 hash:
4f6caebd865502f7c8046fbae3284c61
SHA1 hash:
be357e832bf6f61454875b37a1759cf1c5fa5ca4
Link:
https://www.unpac.me/results/dd6d6e77-9b00-4426-909c-5245958719dc/
SH256 hash:
411569f9f0b865c651adc1234d23f86cd98fe5cd641704702276e9882be113b6
MD5 hash:
7648892096f37af50468509c5b051180
SHA1 hash:
a56a074c2770152761f6c4975db0e9f7d57f8cda
Link:
https://www.unpac.me/results/dd6d6e77-9b00-4426-909c-5245958719dc/
SH256 hash:
fbb47432439f33ae30615490eed007a1b3ba2f3381c17362798a20ec5afb3040
MD5 hash:
9ba4ea7beb3ce1986633d56247c7242a
SHA1 hash:
5604cd446eb680e1e2463143abf8285d744b4035
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/dd6d6e77-9b00-4426-909c-5245958719dc/
SH256 hash:
f1eb77b88dfcb185cad47de5d465a7e55c1371896f2bddf255af3ac00df19944
MD5 hash:
d9a7c7e5cbc98dd9fd22b841a9a815cb
SHA1 hash:
292994535a898f53a07a9ca74ff58204d107075b
Link:
https://www.unpac.me/results/dd6d6e77-9b00-4426-909c-5245958719dc/
SH256 hash:
876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0
MD5 hash:
d272d25b3efc69af38bd135d4e140e16
SHA1 hash:
b01a30bd868035db96beb9998b890be33b2eacad
Link:
https://www.unpac.me/results/dd6d6e77-9b00-4426-909c-5245958719dc/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/876f6337c556/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 86505875cc0ff8433accfde666c6b6971efe12d750a599a85efc38c0066cf845

SnakeKeylogger

Executable exe 876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 86505875cc0ff8433accfde666c6b6971efe12d750a599a85efc38c0066cf845
Cape
Cape
https://www.capesandbox.com/analysis/357042/
  
Dropped by
SHA256 0e0faea0b2a68a7cb076a07a3af6ae449e750cb91596f98b4627915498bd807d
  
Dropped by
MD5 551778a1583222e984178592f1e53085
  
Dropped by
MD5 ff9243cde78caced0b98053e707a036e

Comments