MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b5715e6425f57cd90a2327c1f902e5cafcd2d86269e03bf94080540c61c6e7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 6 File information Comments

SHA256 hash:	8b5715e6425f57cd90a2327c1f902e5cafcd2d86269e03bf94080540c61c6e7c
SHA3-384 hash:	c9d9a88590bb0d64fe3a0896eaca29ea6a54edc58f033767ad42367309ce5dc612b322e706f75045483fe0413417e3f5
SHA1 hash:	2fda52df23a80ec15c98e629e0a592a8787cbc6a
MD5 hash:	ae342688f50384e8d1ce2105ee574dbb
humanhash:	oscar-maine-sodium-bakerloo
File name:	TT_USD_0822220011_PDF.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	12'800 bytes
First seen:	2022-09-02 13:33:37 UTC
Last seen:	2022-09-21 11:53:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	192:UOAssF9bHn7LLKyQY86xjXH9Z3Ivda812A3:UDsU93LLgmjX9Z3IvdFP
TLSH	T1CD42E8106740C22BE97A4635CC725AF10739EF59E943874F2889FE5FBA737520A71A21
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	8f8c82929282820c (3 x SnakeKeylogger, 1 x AsyncRAT)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

312

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/307446/

Detection(s):

SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/631206993e9e50b1baf8c172/reports/7e887f4b-9d28-4c84-a6a5-e074e275640f/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/4c96f261-0599-4a01-90f1-dac6dd05b398

Result

Threat name:

AsyncRAT, Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1064210

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Creates an undocumented autostart registry key

Encrypted powershell cmdline option found

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AsyncRAT

Yara detected Generic Downloader

Yara detected MSILDownloaderGeneric

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8b5715e6425f57cd90a2327c1f902e5cafcd2d86269e03bf94080540c61c6e7c/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-09-02 05:27:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

15 of 26 (57.69%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rnlrlzscl5l43efcgj6b7ebolsx42lmge2pahp4ubacubrq4nz6a._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger stealer

Link:

https://tria.ge/reports/220902-qt4k8sefan/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662

Unpacked files

SH256 hash:

8b5715e6425f57cd90a2327c1f902e5cafcd2d86269e03bf94080540c61c6e7c

MD5 hash:

ae342688f50384e8d1ce2105ee574dbb

SHA1 hash:

2fda52df23a80ec15c98e629e0a592a8787cbc6a

Link:

https://www.unpac.me/results/9332d950-d636-4e81-beb8-8f683d62035c/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8b5715e6425f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/8b5715e6425f57cd90a2327c1f902e5cafcd2d86269e03bf94080540c61c6e7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Discord_Attachments_URL Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads

Rule name:	SUSP_PE_Discord_Attachment_Oct21_1 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:	Internal Research