MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87b3487f64f3be55dd90700c67617d28a65457759e801cefd5369872e3dc2c7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87b3487f64f3be55dd90700c67617d28a65457759e801cefd5369872e3dc2c7f
SHA3-384 hash: 0671a5b0509ec4ac6044596af8fdd30e2fea17d6f253858ab95a8fb0fc4b4a2884b61fc4436a98d6504e8178d850f3ba
SHA1 hash: e5ac210cb54910b2b21ce1845675540b5fdb049e
MD5 hash: 0aa00f0470dc38c15fe8e99376c5e272
humanhash: magazine-illinois-eleven-ink
File name:MILLS NEW ORDER.18022021.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'200'640 bytes
First seen:2021-02-18 08:24:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:GVmMp+Nj6jRPLjRPqjBjjyjBjBjBjBjLj3QoL6o2LE59w8t1chat8Z2hWfTa5hBt:EQpo2LY241cMt7h2Tacul1aWM8M5
Threatray 82 similar samples on MalwareBazaar
TLSH 064537001EA45A09FD6D1B744529D131D3BC9CD28A22E7792EC53C8B38F7E919F66E0E
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: gmail.com
Sending IP: 45.15.143.132
From: Sue Robinson <sue.thestrictlylimitedcompany@gmail.com>
Subject: MILLS NEW ORDER.18022021
Attachment: MILLS NEW ORDER.18022021.rar (contains "MILLS NEW ORDER.18022021.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117698/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/611235
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
May check the online IP address of the machine
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87b3487f64f3be55dd90700c67617d28a65457759e801cefd5369872e3dc2c7f/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 08:25:07 UTC
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6zuq73e6o7flxmqoaggoyl5fctfiv3vt2abz36vg2mhfy64fr7q._file
Verdict:
unknown
Similar samples:
07c08ec8db58e10671dea2e27e69032477b2c9994986d3ddd7d6b5b6cefe5502
SnakeKeylogger
17da3f513b6a83f9514ae00e934257ff56623d438002fb8caa2735348d8cee7c
SnakeKeylogger
2120a958805532d53821fb90eaaa140d8a6461f667b392e352311ff896465f46
SnakeKeylogger
45a2796fe63b4de3b22f992d5259ca8efdf22d33670c5446a71d288d9f182ef5
SnakeKeylogger
503cd6dfb25591a5a8a9ae418d96a55e3492cd4592df5fdc04750faaa7ff5ba6
SnakeKeylogger
7c7f99d2b695777b5809dcee0723304b77a06ea8c72ec8a9e0967e4d8584d585
SnakeKeylogger
9c5f9876b30ee9e81d5dbd88ca98ce817b0629beed1c37f702b5652acb4ec4b1
SnakeKeylogger
9ee1bd8d321c0f2b59c8d9005f174cfdee3476d00f5fa9005655d0ca6bb22afd
SnakeKeylogger
ba41656ca5e0e243cff9f6a536c43998a9dbc492f5e813a0022e84359b2e0ef8
SnakeKeylogger
c3a69db8642855e1dfcbcb213f7f050c5fb2d86744183b13483411f97009c2a0
SnakeKeylogger
+ 72 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210218-b4vnd3k3ln/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
b2f91d1427c7b60a3ad485bed04ba75636560783c9265a8f26542d5f6aa5d8a9
MD5 hash:
5ad6dc03137fc80e4e691f4b409d9120
SHA1 hash:
edb38e49ce79ecce33ce9a891df56468c3a4016e
Link:
https://www.unpac.me/results/bdae846e-26c7-446a-a454-c9178909cebb/
SH256 hash:
87b3487f64f3be55dd90700c67617d28a65457759e801cefd5369872e3dc2c7f
MD5 hash:
0aa00f0470dc38c15fe8e99376c5e272
SHA1 hash:
e5ac210cb54910b2b21ce1845675540b5fdb049e
Link:
https://www.unpac.me/results/bdae846e-26c7-446a-a454-c9178909cebb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87b3487f64f3be55dd90700c67617d28a65457759e801cefd5369872e3dc2c7f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 12fe89d0b26cbcddb8d6ab034db718afc5a908a76b5bb46502d088536b62361a

SnakeKeylogger

Executable exe 87b3487f64f3be55dd90700c67617d28a65457759e801cefd5369872e3dc2c7f

(this sample)

  
Dropped by
MD5 f80cf8e2df0e8c4b1aa03b9a91c98ed7
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/117698/
  
Dropped by
SHA256 12fe89d0b26cbcddb8d6ab034db718afc5a908a76b5bb46502d088536b62361a

Comments