MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
SHA3-384 hash: 54f2e512c5c50b4ed9a81ec18042c020d41918f0cc1220716f0516121e66ab179796ca7b0c0f99953a0cd0a3238cd2ce
SHA1 hash: aa6194967f091d6ad78ee72b937dde20a89fcfb9
MD5 hash: d064646721e6e070b61daecc9396bd63
humanhash: carolina-princess-one-blue
File name:Vessel Details.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:790'528 bytes
First seen:2024-01-03 12:26:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:dJpHCmbibyjK567+fJzJjIOppNcTB+iIPsMI:ZCtyjK5QyJjIGpNcT+P
TLSH T13CF46A41A7E4CB2DE6B20275F9724134DE36FA8A2855C75F705C352E2F33B148A636A3
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 0b1939694d4d6923 (23 x SnakeKeylogger)
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
430
Origin country :
HU HU
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Query of malicious DNS domain
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin msbuild packed regasm
Link:
https://www.filescan.io/uploads/659552a8ffafd83ebca4ade3/reports/cf4d680e-752c-40bb-9a72-6949ca605c05/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2b5f7757-8dd3-45ab-89bc-7ca962bcd95f
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1369247
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeyLogger
Create hunting rule
Status:
Malicious
First seen:
2023-12-25 13:23:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r5ccag2whghdaqs5vm7zttniysiohng62x4nkro6dd3xt4p6w3uq._file
Verdict:
malicious
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/240103-pmrgnachhl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
73f6fe4ecb819f7f18bd1de80e6126bef838a8f1e1a0ab3615303f21f6ea96ca
MD5 hash:
6aa79cd0168a92984b67e078dd43d9e9
SHA1 hash:
e763f055cdc39758d0a0840cdf3464ce3bd03e07
Link:
https://www.unpac.me/results/2ee140ee-1c27-48c5-865b-02591b479f2a/
SH256 hash:
45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b
MD5 hash:
fb1bc19121c4e190d83672bc71b493f0
SHA1 hash:
c3488b969ba578e28ee360be24b6416425a224a0
Link:
https://www.unpac.me/results/2ee140ee-1c27-48c5-865b-02591b479f2a/
SH256 hash:
310b20a5abed2bdd0c8ad7596ff8ae46e6332c356762c71ba6fdf30f813b2071
MD5 hash:
a80bdd93bc7e526ca5e37ab3ab31b3e8
SHA1 hash:
31d916ab6e920790f7f3655e7c54930a0ccade57
Detections:
snake_keylogger
Create hunting rule
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Link:
https://www.unpac.me/results/2ee140ee-1c27-48c5-865b-02591b479f2a/
Parent samples :
2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b
71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118
f0df0ec243153f35a5522715fb79c372fde175ad98596185ec2eea5a16a535bf
f63b61933ecd47ebf5c5c79fb5e30c89852dc271dab0a6df17015392e1158293
545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d
becd887276df85a4eea5b2837327ee6eea59f0f7579f7894a8307e4681b9b5d4
13f500cb766e4c37869fb3286cbefb2c2ecefb4a799ef7e5723f574a842d5647
ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
fd3215fd4bcb33f2149cd4bed63011c2b992b5a008cdd289559031741e8a3089
43a5ebb280e2770fe10bbb4e598c80456f8fd86b720cf50ecef20d7fbc1423b6
7eebc8928fee351d731226a9abbf7ce6e5833072b18721c603573fc8ff4c6e16
aa733006f49afe10de1ea472aba0b3e8e8192bc59d3a3b244d6953d493e57be9
4e8b17d34495b7e4397939448da55c81d186794fa6a1f00a5e3cbd4659dd74ac
b2ca317d8e7369cd7f839b2db7df1e53b7535ae432ce247e933e8dfa8917e3f5
409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5
dc13c362ff576c7b7733c08175dd2f581ffd40aeb8b090823c18f04ece12ca01
576ca0fbe491aadd6c66a937af35e94d616d9dd9c079b3c7c617fa25b7010700
38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f
d805b874ab77c6272e89f57f5b6f080b039f42064a85778a7ff4bf436575cf68
6a3eefff7806a0b03f089f6b53f17a1db9b6de86cb5c28c798a1b5244fbe7aa8
6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3
8e84d73c7aad92d849e23543da0276e3a1abb8e7c8ea46197bcc01f7b7c4662d
1af4b1e67dee34e1ce541150c83e1be4f75766d47ecebf4b476cb08aa04fa837
5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370
4c91634a53fddb78f1737e66c0c323cdbc8d2e720a14732b8336e449ce062319
8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
7a66c663f71aff27ef5671579fd986b30c9527e23da7cbcfe7cdad8bf8baf739
4cb94e5cf28dc29ec74d5171838ec3735632812576708ec1bf1654b87b18215e
7dca5662fe7621ffd890ac202dd50e9d22b8f2ca186490ad62d8813cc0727cdb
dd2bb6ea65c082f25a75158f22c2d10e3be1daa026334a8d8e06007bbd245f70
b8410c46b62f3f4fa0255c4fa37c4899f2fa7ee69883d35bd178e629e2db24db
d85b912c5171741966d6c8238db04de39b56ed1b696ccf7a32400d34cd29338c
66b79b9bbc034503f2c6330157047506b561d119031d0dd9d03ff87153e01ec5
SH256 hash:
8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
MD5 hash:
d064646721e6e070b61daecc9396bd63
SHA1 hash:
aa6194967f091d6ad78ee72b937dde20a89fcfb9
Link:
https://www.unpac.me/results/2ee140ee-1c27-48c5-865b-02591b479f2a/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8f44201b5639/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments