MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 908e2f2122082381b0c7bc79a851540882ee0c8b385a3ace122ceaeda66bfd1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 908e2f2122082381b0c7bc79a851540882ee0c8b385a3ace122ceaeda66bfd1a
SHA3-384 hash: 54e15715bb1ebe4b68763bf7b6b8586394cb737ffa3c1118b9f9fd965efc8b213c11ec270e54daf7457a1b6adcf2d204
SHA1 hash: 904447175a13d59abc0ba6b01457bd4283c9de1c
MD5 hash: 1824f049737af7506782ccf83fa4c755
humanhash: neptune-blossom-louisiana-beer
File name:BC440551-55011TP.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:569'395 bytes
First seen:2025-01-30 10:40:12 UTC
Last seen:2025-02-03 06:29:16 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:sIBLKNzNc9+8VcG1Hmxn5DJ9cRkM4V4bAMqaE29Nnd/2zX/qc:NJKNBc9+8SG1HmF5DJ9Ec2EMqaUrqc
TLSH T1EFC4230805FADC1821ED0CE608F34F24DA5E07DDB9C4DB4088DBAFA2577216E7ED655A
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter cocaman
Tags:rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Notification <wallstreetfinancekings@gmail.com>" (likely spoofed)
Received: "from youthful-brahmagupta.2-59-163-125.plesk.page (unknown [2.59.163.125]) "
Date: "30 Jan 2025 05:01:01 +0000"
Subject: "Certificate 01-30-2025"
Attachment: "BC440551-55011TP.rar"

Intelligence

File Origin
# of uploads :
6
# of downloads :
96
Origin country :
CH CH
Vendor Threat Intelligence
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=679b580529ae628cf42b8f14
Tags:
autoit emotet snake
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/908e2f2122082381b0c7bc79a851540882ee0c8b385a3ace122ceaeda66bfd1a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/908e2f2122082381b0c7bc79a851540882ee0c8b385a3ace122ceaeda66bfd1a/
Threat name:
Win32.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-01-30 05:01:19 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
21 of 38 (55.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=schc6ijcbarydmghxr42qukubcbo4delhbndvtqsftvo3jtl7una._file
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger stealer
Link:
https://tria.ge/reports/250130-s62zaavqbw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
VIPKeylogger
Vipkeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7965348925:AAGe8wdrvk9A3lxr1GIjGigodJ_zZ7prhfs/sendMessage?chat_id=6848903538
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/908e2f2122082381b0c7bc79a851540882ee0c8b385a3ace122ceaeda66bfd1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 908e2f2122082381b0c7bc79a851540882ee0c8b385a3ace122ceaeda66bfd1a

(this sample)

SnakeKeylogger

Executable exe ebe17d8d5574e603070eb2d958461bb3eb87f54b7b590c1bb86aac0cacff426c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ebe17d8d5574e603070eb2d958461bb3eb87f54b7b590c1bb86aac0cacff426c
  
Dropping
SnakeKeylogger
  
Dropping
MD5 40580338d3b2de78292bc92fb2772978

Comments