MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 15

Intelligence 15 IOCs YARA 13 File information Comments

SHA256 hash:	8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9
SHA3-384 hash:	cccda1f083045e34c68305a501a1c96bbd34c50bde1bd6d9d37fc328cf49e343f5584ae45784a4cb03a9fff0c094c820
SHA1 hash:	f19b8960681b56cab45a9f14871108cf4d522251
MD5 hash:	64932c473d74fbdfdb706a094543cf37
humanhash:	stream-video-sink-mockingbird
File name:	DNXS-04-22.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	888'832 bytes
First seen:	2024-05-02 05:58:38 UTC
Last seen:	2024-05-02 06:26:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:y2iNzeWFm+1okFwe6N9LtinuoFZK4s5ehC3s5IrA6tN/uYiXdwsh:y1tRFm+1okFPOtT4OgC3s5IlNxi
Threatray	5'814 similar samples on MalwareBazaar
TLSH	T128155DD1F1508D9AE96B05F2BD2BA53024E37E9D54A4810C569ABB1B76F3342209FF0F
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter	lowmal3
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

307

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9.exe

Verdict:

Malicious activity

Analysis date:

2024-05-02 06:04:17 UTC

Tags:

evasion snake keylogger

Link:

https://app.any.run/tasks/065a2870-9a09-424a-8cfc-16739af2bd43

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Porcupine.Malware.58887.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for synchronization primitives

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

DNS request

Connection attempt

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/66332ba60694596be92e6ebc/reports/46d98be0-8d7a-449a-b275-391a794f3a7a/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e1d2532b-5757-4bd7-bc78-8e1a4d7c1d38

Result

Threat name:

PureLog Stealer, Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1435145

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2024-04-30 06:16:55 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=roo63kqj2i4wm7ozzk7ay7x2wylrfbulglv3hjibcdpytaechtuq._file

Verdict:

malicious

SnakeKeylogger

875a00af88e95f034c99ef011c771492c104850557e7c742ac71d76a92a86fb7

SnakeKeylogger

95e4dd6cc5a341f4440a113e0a832175aa2f5baafd9c7483255a18088e1c2764

SnakeKeylogger

c1ecdc617db839e561aa5318e3458ce0f0db30386f8b9cb5586314b2e75a8a7d

SnakeKeylogger

d46066c4c4bd510c11a5d4ee6e23ff0e2fdb7d5d716aceb9671caa3e679800b1

SnakeKeylogger

+ 5'804 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/240502-gpqn5sag3x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://scratchdreams.tk

Unpacked files

SH256 hash:

ef9ed22460ea03d86123fd8c2755016839267315038b92fb496bfe020c186438

MD5 hash:

ab257f0aee0b1095ea6ccfd97d95d03d

SHA1 hash:

bc41435d391258fa2e98660b179bcefebf7aec54

Link:

https://www.unpac.me/results/526b5d25-7a7b-45ce-9865-88bd3fc991af/

SH256 hash:

20149bf1f305ca19e8b03288c79f26f017a20a4e5a1f6e46beb88938d5349af4

MD5 hash:

1c2daa040e1abd0dd3b7a5589f60b715

SHA1 hash:

530466e0ea2571d44a9de98ad8e55682e372363c

Detections:

snake_keylogger

win_404keylogger_g1

MAL_Envrial_Jan18_1

MALWARE_Win_SnakeKeylogger

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Link:

https://www.unpac.me/results/526b5d25-7a7b-45ce-9865-88bd3fc991af/

Parent samples :

d46066c4c4bd510c11a5d4ee6e23ff0e2fdb7d5d716aceb9671caa3e679800b1
672047c9f1f92700303fa90df3ecce9faf67138888eedce5fd47a599120e0ec5
8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9
1884a949e9068ffe0dd84be7644cd3a8fe320542252e533ce1d2214f79b50990
9745e0d21f50b1c553b40e8c353b11bb172a2bae1a83b3b9cfce26f9e01b3b89

SH256 hash:

bf24e3d51b96eb9687fbd9107df383008c95d18244300d0f2270864dea830dd7

MD5 hash:

9b65b3f5b4b6df39b0655be15b23f50c

SHA1 hash:

52a81b7d5377d6aa7a5ef4565b9266c73fa9dd4b

Link:

https://www.unpac.me/results/526b5d25-7a7b-45ce-9865-88bd3fc991af/

SH256 hash:

7d592a5fc2662373b0200e5590cb1eeb8f00a1061af1657e476113d2134cd2a6

MD5 hash:

bc900e3fc47830420d713c1e33cbed15

SHA1 hash:

1e0241627fc669541a25d2dba5a48b43ec1718fe

Link:

https://www.unpac.me/results/526b5d25-7a7b-45ce-9865-88bd3fc991af/

SH256 hash:

8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9

MD5 hash:

64932c473d74fbdfdb706a094543cf37

SHA1 hash:

f19b8960681b56cab45a9f14871108cf4d522251

Link:

https://www.unpac.me/results/526b5d25-7a7b-45ce-9865-88bd3fc991af/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8b9dedaa09d2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8b9dedaa09d239667dd9cabe0c7efab61712868b32ebb3a50110df8980823ce9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Delivery method

Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample