MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fdc11d9410980aceabd9afeb6280fb30fa0d9c45c051ce17ef826f3c067482f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fdc11d9410980aceabd9afeb6280fb30fa0d9c45c051ce17ef826f3c067482f
SHA3-384 hash: 18ccc0da5a736e310279a687e0a063cbf29f849f31be09b6aeb801c69b8f3cf70aa5ccc017224da15c85a738aebc2a5f
SHA1 hash: 1c618ec1a0a78d23dcb9f984a7e9a4d68346d30d
MD5 hash: e5a9cd9b868fc941fd27123e84f0206d
humanhash: zulu-bakerloo-black-moon
File name:MT. Erawan.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:71'490 bytes
First seen:2022-06-15 06:23:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:jkRinQgkifGoAlx8hhOQtULTSOYS/23Yt6JQAMMzQR/5pDp66mh:IivMXvdLmcn2MMIpdmh
TLSH T14E6312EC6912E939B7D883FD222B4405227169CFC6B2EE7A9DE7221C06042464C7777F
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Maudi Rezki - MFP <maudi.rezki@capcx.com>" (likely spoofed)
Received: "from capcx.com (unknown [193.233.191.159]) "
Date: "15 Jun 2022 01:48:38 +0200"
Subject: "=?UTF-8?B?TVQuIEVyYXdhbiAxMiDigJMgQWdlbmN5IEFwcG9pbnRtZW50IOKAkyBWMTIyMSDigJM=?="
Attachment: "MT. Erawan.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8fdc11d9410980aceabd9afeb6280fb30fa0d9c45c051ce17ef826f3c067482f/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2022-06-14 11:09:00 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
18 of 40 (45.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r7obdwkbbgakz2v5tl7lmkapwmh2bwoelqcrzyl67atphqdhjaxq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence stealer
Link:
https://tria.ge/reports/220615-g52rcadcd9/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot1840149904:AAF9D1mm8ZITxzSWfLFbRBfwFML1TyPoOMk/sendMessage?chat_id=-782794228
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8fdc11d9410980aceabd9afeb6280fb30fa0d9c45c051ce17ef826f3c067482f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 8fdc11d9410980aceabd9afeb6280fb30fa0d9c45c051ce17ef826f3c067482f

(this sample)

SnakeKeylogger

Executable exe 7d343083e149e5d4e396c15eb6c1b23beb53c864f554b4d72ee364a1b587a274

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d343083e149e5d4e396c15eb6c1b23beb53c864f554b4d72ee364a1b587a274
  
Dropping
SnakeKeylogger

Comments