MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89f1983ad923c2485a4b4e06b168a096546d35fd90e88d26485756a37fc4a829. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	89f1983ad923c2485a4b4e06b168a096546d35fd90e88d26485756a37fc4a829
SHA3-384 hash:	39380d2fc0ba710c5a9557d94d5d03bcdfe323c735266634c017243df646677094be3a45b9555a88635c53eda73368a6
SHA1 hash:	5fb6a749371864c0a0a4c5be6faee65385126976
MD5 hash:	6f8faaa0b38d96d6a22e77ef6bb92c5e
humanhash:	oxygen-queen-carpet-spaghetti
File name:	Updated SOA8203204927107.pdf.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	2'781'696 bytes
First seen:	2021-02-16 13:21:54 UTC
Last seen:	2021-02-17 22:51:32 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	49152:soZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgG9d:xX0zlC6mt98S2mnwQ1a7r
TLSH	F3D54F7C8C2D9C12B785126FDC5A07830FDAA7F5EB552C4D4A23836DCA8363B671846E
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

abuse_ch

Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.107
From: Binoy M R <info@supertorque.ae>
Subject: Updated SOA
Attachment: Updated SOA8203204927107.pdf.gz (contains "Updated SOA8203204927107.pdf.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/117326/

Detection(s):

SecuriteInfo.com.Artemis6F8FAAA0B38D.26912.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Creating a window

DNS request

Sending an HTTP GET request

Sending a UDP request

Sending a custom TCP request

Reading critical registry keys

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/608925

Signature

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Beds Obfuscator

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89f1983ad923c2485a4b4e06b168a096546d35fd90e88d26485756a37fc4a829/

Threat name:

ByteCode-MSIL.Backdoor.Remcos

Status:

Malicious

First seen:

2021-02-16 09:47:07 UTC

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rhyzqowzepbeqwsljydlc2faszkg2np5sdui2jsik5lkg76evauq._file

Verdict:

unknown

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210216-51437flmv6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Beds Protector Packer

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf

MD5 hash:

8cd28be4bd9a1404c6d3600db32b3ed1

SHA1 hash:

fb90b0ca51118e771390d58b19d0a404ee14cfbc

Link:

https://www.unpac.me/results/18275ebd-3a26-432e-b075-520c95086f5d/

SH256 hash:

aeddfb17d2469de3d21e34d91a4568b9df292bdf9ee8e48ab384187928f0a74c

MD5 hash:

ad998599bc1db8173ba34a3c5d776e45

SHA1 hash:

4268822f90d7bc5a3ec981c539f9ac03bed2b9d1

Link:

https://www.unpac.me/results/18275ebd-3a26-432e-b075-520c95086f5d/

SH256 hash:

15059f872f603765ec3e26a3ea24ba99988b4613406b21efabfdc2110f3cdfe7

MD5 hash:

ed112022834aedbd69790666b589c6f7

SHA1 hash:

075232392f3f304ce9e2b58949b61dad6db5b1a1

Link:

https://www.unpac.me/results/18275ebd-3a26-432e-b075-520c95086f5d/

SH256 hash:

89f1983ad923c2485a4b4e06b168a096546d35fd90e88d26485756a37fc4a829

MD5 hash:

6f8faaa0b38d96d6a22e77ef6bb92c5e

SHA1 hash:

5fb6a749371864c0a0a4c5be6faee65385126976

Link:

https://www.unpac.me/results/18275ebd-3a26-432e-b075-520c95086f5d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/89f1983ad923c2485a4b4e06b168a096546d35fd90e88d26485756a37fc4a829

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector