MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb
SHA3-384 hash: 5d289fc7524325ac75b3c27e7379bda4cbafa1d03e0dafefa40b9d3e0acb425d0f79400df1fae28f9648b0c127ea0d7a
SHA1 hash: 3d6358c1b2701a312dc122f93273ebbfc3dfd21d
MD5 hash: 3fd6b0dfba92672fb38a346577b75eb4
humanhash: mountain-floor-sixteen-bacon
File name:3fd6b0dfba92672fb38a346577b75eb4.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'043'456 bytes
First seen:2023-06-17 09:49:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:QoAcuF6mn1DHLZnvJFNiOe42KMu/N3mWhQmwmJCMpUdgKPBEVZCMdxrYow4MWoSR:OiOV/NOa8gK5EVMqC9WbeOKEJB
TLSH T187257FD1F190889BE96F0AF16D2A653010E77E9D64A4C10D569EBB1A76F334220DFE0F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3fd6b0dfba92672fb38a346577b75eb4.exe
Verdict:
Malicious activity
Analysis date:
2023-06-17 09:52:53 UTC
Tags:
blackguard snake
Link:
https://app.any.run/tasks/62c5a0c7-3fda-48b5-beab-595004bdb515

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/399753/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.100481.26530.3743.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/648d81cb2a7042b8741cf6a2/reports/9a143cac-7d2c-4f4f-988d-5bff44c630b0/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cc393c3c-778e-402c-b801-745fe65047e8
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1256438
Signature
.NET source code contains potential unpacker
Found malware configuration
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-12 02:28:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
36
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=skhh6vhmk7x7paammtaj7sa3fwkryrhtmyub7js2qxngbluy7c5q._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230617-ltxqgaah4t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6099030244:AAG20Xctn1dMSsohvWQve2z3FNZZiXV7rzI/sendMessage?chat_id=6112855473
Unpacked files
SH256 hash:
053ba3f07a6d60be5cc309e11e9b77001e5ca92def4f3bdafcace56630e474f4
MD5 hash:
f1f1b1153ffcb76b7b13a676911db67c
SHA1 hash:
e57e5e76cdfce7ef8eda91f6ffd94ffcf12a04ad
Link:
https://www.unpac.me/results/cb116abe-5f18-467b-b88d-60152acc315e/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/cb116abe-5f18-467b-b88d-60152acc315e/
SH256 hash:
dd8ef574348453603ca4f7f40cc4dc6a9d4f7df5c99c78fd0394c9ad1157639c
MD5 hash:
88201d970dd9e2cd88dc8b3f7b81e67c
SHA1 hash:
cae80ac0bc9a22070f43c3f68ae2b5494a36b5a2
Link:
https://www.unpac.me/results/cb116abe-5f18-467b-b88d-60152acc315e/
SH256 hash:
0f77e88c0dc30b1035c3cc93be5aca39025c8dce2fc58658d55829eb309153c9
MD5 hash:
69a702a826aca70ca1f20d07d2bbff53
SHA1 hash:
a691e500d1453497208f7148e05cd022fe93c2a0
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/cb116abe-5f18-467b-b88d-60152acc315e/
Parent samples :
b11454a0c9137a7b39890ca3a5221fb602929a07f080f53a6c14e91989d853db
928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb
61e078d216229dec7f1fc09d3e3276167dde775b252bead7a5e28622a68a8d68
1e28ab95c508a3b0d17dd7279384d0353cd7fa83f6f5138746ed0b44679ee1c0
51ba1d90c26c91d54ec6e4e9f357b3d06047248df2ca9ee071eb12565b79ac5b
SH256 hash:
f8dbc6077f6b01c6eec334061d687ff1b291a2aa5513cf1e0b5bde4a8dbc5588
MD5 hash:
15aab611795bcbf2758052944013be1a
SHA1 hash:
772a1002b111e117cf3b1e9f0cabda4894777399
Link:
https://www.unpac.me/results/cb116abe-5f18-467b-b88d-60152acc315e/
SH256 hash:
928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb
MD5 hash:
3fd6b0dfba92672fb38a346577b75eb4
SHA1 hash:
3d6358c1b2701a312dc122f93273ebbfc3dfd21d
Link:
https://www.unpac.me/results/cb116abe-5f18-467b-b88d-60152acc315e/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/928e7f54ec57/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/399753/

Comments