MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8989b8399cdc3d5e8e2ba46017f574dbdd88abba54c38c79028e5de53622c2e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8989b8399cdc3d5e8e2ba46017f574dbdd88abba54c38c79028e5de53622c2e7
SHA3-384 hash: d86b96eaa7737b81eff5d61527419ed9e57936fac58de8afbd9861a8d0f12df103c59ecd9e62afb9c2b3c5ae8b9fa9df
SHA1 hash: bf449d9635fdd811d608e86da0a47a19826ad7be
MD5 hash: f40fb54eac2da697a9511274316c3db9
humanhash: ohio-connecticut-chicken-angel
File name:SecuriteInfo.com.Trojan.DownloaderNET.154.8159.28049
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:75'776 bytes
First seen:2021-04-08 12:54:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:sPSBdtS1BtSRhVxBmpelqdh9jdKA7HbHCNUkL9bEGflfGflvx/FIwJGun51uNGfJ:0SBdtS1BtSRhjoSMrdO9bXU
Threatray 22 similar samples on MalwareBazaar
TLSH 9E73B7EC7BE4C4F7D96CF9709182BC75A734A836E811095F458ED2C38426ED22BD427A
Reporter SecuriteInfoCom
Tags:SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.DownloaderNET.154.8159.28049
Verdict:
Malicious activity
Analysis date:
2021-04-08 16:25:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/19528db8-0c54-4a6d-8ca4-066bafc22a91

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133207/
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.154.8159.28049.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file
Launching a process
Creating a process with a hidden window
Creating a window
Sending a UDP request
Running batch commands
Unauthorized injection to a recently created process
Adding an access-denied ACE
Launching the default Windows debugger (dwwin.exe)
Sending an HTTP GET request
Sending a custom TCP request
Sending a TCP request to an infection source
Setting a single autorun event
Sending an HTTP GET request to an infection source
Adding exclusions to Windows Defender
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b7b3afc8-7817-4612-b75d-1dd9a3df2bb4
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/670180
Signature
Adds a directory exclusion to Windows Defender
Contains functionality to hide a thread from the debugger
Drops PE files with benign system names
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 384036 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 43 checkip.dyndns.org 2->43 45 freegeoip.app 2->45 47 checkip.dyndns.com 2->47 59 Found malware configuration 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 Yara detected Snake Keylogger 2->63 65 3 other signatures 2->65 8 SecuriteInfo.com.Trojan.DownloaderNET.154.8159.exe 18 7 2->8         started        13 svchost.exe 2->13         started        15 svchost.exe 9 1 2->15         started        17 6 other processes 2->17 signatures3 process4 dnsIp5 55 myliverpoolnews.cf 104.21.56.119, 443, 49707, 49708 CLOUDFLARENETUS United States 8->55 39 C:\Users\Public\Documents\...\svchost.exe, PE32 8->39 dropped 41 C:\Users\...\svchost.exe:Zone.Identifier, ASCII 8->41 dropped 73 May check the online IP address of the machine 8->73 75 Adds a directory exclusion to Windows Defender 8->75 77 Tries to delay execution (extensive OutputDebugStringW loop) 8->77 85 3 other signatures 8->85 19 SecuriteInfo.com.Trojan.DownloaderNET.154.8159.exe 8->19         started        23 cmd.exe 8->23         started        25 powershell.exe 24 8->25         started        27 3 other processes 8->27 79 Multi AV Scanner detection for dropped file 13->79 81 Machine Learning detection for dropped file 13->81 83 Hides threads from debuggers 13->83 57 127.0.0.1 unknown unknown 15->57 file6 signatures7 process8 dnsIp9 49 checkip.dyndns.org 19->49 51 checkip.dyndns.com 131.186.113.70, 49724, 49725, 49731 DYNDNSUS United States 19->51 53 2 other IPs or domains 19->53 67 Tries to steal Mail credentials (via file access) 19->67 69 Tries to harvest and steal ftp login credentials 19->69 71 Tries to harvest and steal browser information (history, passwords, etc) 19->71 29 conhost.exe 23->29         started        31 timeout.exe 23->31         started        33 conhost.exe 25->33         started        35 conhost.exe 27->35         started        37 conhost.exe 27->37         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8989b8399cdc3d5e8e2ba46017f574dbdd88abba54c38c79028e5de53622c2e7/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 10:04:53 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rge3qom43q6v5drlurqbp5lu3poyrk52ktbyy6icrzo6knrcyltq._file
Verdict:
unknown
Similar samples:
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb
SnakeKeylogger
27cb289230f6544ef667488a02ee6967b9f1c4cf0c9a4c4d57af8a374b2241d9
SnakeKeylogger
397a62fc978f7a97a87caaf9c35e98e4a053de4e786beee73a6c1ac0e99c9fc9
SnakeKeylogger
552a8d763c86bb50ded18cf8f790f18828c471ec5a4d3cac71eaf7693314a04c
SnakeKeylogger
8dead61d3783e37eef1dc2062acd13670f59da4f0dab124d533dd4d684b3ed60
SnakeKeylogger
94bb5cf3b2d56807ecdff0d731b5bea776de7a22bd15c3bdd256157e8a0c02b8
SnakeKeylogger
9c4fe6c162057e7e0e1f8bd7cf9cbcdea59cd345af0b3cf76e9c59b09c7334d4
SnakeKeylogger
a5992480bee1593ae9ceffd2163473b4c9e22431d0119ec3fb81435f0828e5a7
SnakeKeylogger
c3528956666ac901c406c13e9b265cb805424e91919db91a1fe2227ffbc15c7a
SnakeKeylogger
ee54b187c42f159bfba469c4b8c5ba0a85afeb802ea7eacaf400ccb38f7183af
SnakeKeylogger
+ 12 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210408-y6ljkfbqxe/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Snake Keylogger
Snake Keylogger Payload
Windows security bypass
Unpacked files
SH256 hash:
8989b8399cdc3d5e8e2ba46017f574dbdd88abba54c38c79028e5de53622c2e7
MD5 hash:
f40fb54eac2da697a9511274316c3db9
SHA1 hash:
bf449d9635fdd811d608e86da0a47a19826ad7be
Link:
https://www.unpac.me/results/af32ddef-9578-466f-b5a4-a8cb9efe4c3a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/8989b8399cdc3d5e8e2ba46017f574dbdd88abba54c38c79028e5de53622c2e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe 8989b8399cdc3d5e8e2ba46017f574dbdd88abba54c38c79028e5de53622c2e7

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/133207/
  
URLhaus
https://urlhaus.abuse.ch/url/1104307/
  
Delivery method
Distributed via web download

Comments