MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c60e4c3f801f1054e43e5fd1bc9910b29584b3db99f2224684e0343188b89d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	8c60e4c3f801f1054e43e5fd1bc9910b29584b3db99f2224684e0343188b89d5
SHA3-384 hash:	e8c9cc9af566c34c5e585897a87b1c0166dbb553350b41457027970932301253c741cf88d83de1564c3d269fd1e25b14
SHA1 hash:	ac2523309b5bae7671f5d914ed85fdd11819e810
MD5 hash:	15f0423cfda5eedcb0f73022c28d9eca
humanhash:	single-high-coffee-oven
File name:	parcel_document003,pdf.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	654'336 bytes
First seen:	2021-03-03 18:14:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:TS58teodM4fNDVbUs2yxS4en8+cdT3pO1VHjuz8zM17SlyAKp:Ts4e8xd7E/DuQzM1+lWp
Threatray	1 similar samples on MalwareBazaar
TLSH	C7D45BFC605E60EED0F7B9B23FD9A42C96957255A34B641F208053474173A62FF8BA38
Reporter	abuse_ch
Tags:	DHL exe SnakeKeylogger

abuse_ch

Malspam distributing SnakeKeylogger:

HELO: v198.ncsrv.de
Sending IP: 89.110.144.212
From: DHL <gina.ruiz@dhl.com>
Subject: ***Virus*** Re: DHL Delivery
Attachment: parcel_document003,pdf.zip (contains "parcel_document003,pdf.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

parcel_document003,pdf.exe

Verdict:

Malicious activity

Analysis date:

2021-03-03 18:22:11 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/129aed90-109b-4982-91c4-04e6e0112f73

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/121933/

Result

Verdict:

Clean

Maliciousness:

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/626510

Signature

.NET source code contains very large strings

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Beds Obfuscator

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8c60e4c3f801f1054e43e5fd1bc9910b29584b3db99f2224684e0343188b89d5/

Threat name:

ByteCode-MSIL.Trojan.Malrep

Status:

Malicious

First seen:

2021-03-03 15:59:40 UTC

AV detection:

18 of 29 (62.07%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rrqojq7yahyqktsd4x6rxsmrbmuvqsz5xgpsejdijybuggelrhkq._file

Verdict:

unknown

SnakeKeylogger

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210303-rhbnvbx9za/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

12b6262e152535bd99e50ded7eb1a94ea64731d9f376cd7fd9fdd2cefb1d6eb2

MD5 hash:

169142bf17247ec5d50dc3423e92c53f

SHA1 hash:

eb9ec5a6d00f67ce96645aa52bc38384a8f78d34

Link:

https://www.unpac.me/results/62b974a2-b01f-45e9-a4fd-5df76168432d/

SH256 hash:

f8b5b51efedb3e87493ac2439473564603cc3059d57956f209a7310e311a1027

MD5 hash:

d66f89bf838fb52ed59d311a99aea214

SHA1 hash:

342525c4aabbb92abf51459081d34ed0f1cdc965

Link:

https://www.unpac.me/results/62b974a2-b01f-45e9-a4fd-5df76168432d/

SH256 hash:

c53775aeec0a52ac03fd8929da47d47b05c3bad1241a1248de17ee8980caef6c

MD5 hash:

a5d212399bc449558273c097b8ea1bcc

SHA1 hash:

18a59ffd5144978821b9d2b39e5be94bbe2c3819

Link:

https://www.unpac.me/results/62b974a2-b01f-45e9-a4fd-5df76168432d/

SH256 hash:

8c60e4c3f801f1054e43e5fd1bc9910b29584b3db99f2224684e0343188b89d5

MD5 hash:

15f0423cfda5eedcb0f73022c28d9eca

SHA1 hash:

ac2523309b5bae7671f5d914ed85fdd11819e810

Link:

https://www.unpac.me/results/62b974a2-b01f-45e9-a4fd-5df76168432d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/8c60e4c3f801f1054e43e5fd1bc9910b29584b3db99f2224684e0343188b89d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector