MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14
SHA3-384 hash: 4cfb87c779987e0c3efbb9cef13748af7bd2b51b98e8f7169b4573435edbdf8670a4674497d5d2f053fa1bb858b1b15b
SHA1 hash: fbee28c86835f0a8f702e5e84a480cc254df99d7
MD5 hash: 87817dff8804ac16744cc5bfc8e922b1
humanhash: victor-utah-sweet-burger
File name:SecuriteInfo.com.Trojan.DownLoader39.62327.3255.19645
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:309'631 bytes
First seen:2022-11-01 20:02:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:GBlL/b/idtSHFKChxfgruxEMUwnjiIE6UFQBy2/m4S9eMw+m/h+1uUfuX:EVajgffInMjnjTUFQB4TTmJ+m
Threatray 4'740 similar samples on MalwareBazaar
TLSH T1CB64121AF6D4CC73E44209B11CB65671B3B34759802C951BC3BCEEAD9876AC2D12ACD7
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
dhash icon 4f07090d0d014f8c (47 x SnakeKeylogger, 17 x Formbook, 13 x AgentTesla)
Reporter SecuriteInfoCom
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.DownLoader39.62327.3255.19645
Verdict:
Malicious activity
Analysis date:
2022-11-01 20:06:16 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/87f5b1ae-b75c-49a3-ad8b-29965a0db31d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/326906/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader39.62327.3255.19645.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a file in the %AppData% subdirectories
Launching a process
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/47287/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63617b7b791bb7e48afe011a/reports/dcf03e5e-5af0-452d-98ff-e89d362ba803/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/294590d1-c233-4df2-a42a-befa072c2bdc
Result
Threat name:
GuLoader, MassLogger RAT, Snake Keylogge
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1102782
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to capture screen (.Net source)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected GuLoader
Yara detected MassLogger RAT
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 735443 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 01/11/2022 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Multi AV Scanner detection for domain / URL 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 11 other signatures 2->51 7 iakmuqp.exe 17 2->7         started        11 SecuriteInfo.com.Trojan.DownLoader39.62327.3255.19645.exe 1 21 2->11         started        13 iakmuqp.exe 15 2->13         started        process3 file4 25 C:\Users\user\AppData\Local\...\System.dll, PE32 7->25 dropped 55 Antivirus detection for dropped file 7->55 57 Multi AV Scanner detection for dropped file 7->57 59 Machine Learning detection for dropped file 7->59 15 MSBuild.exe 4 7->15         started        27 C:\Users\user\AppData\Roaming\...\iakmuqp.exe, PE32 11->27 dropped 29 C:\Users\user\AppData\Local\Temp\dynjhkvd, DOS 11->29 dropped 31 C:\Users\user\AppData\Local\...\System.dll, PE32 11->31 dropped 61 Writes to foreign memory regions 11->61 63 Maps a DLL or memory area into another process 11->63 18 MSBuild.exe 15 4 11->18         started        signatures5 process6 dnsIp7 33 132.226.8.169, 49706, 80 UTMEMUS United States 15->33 35 checkip.dyndns.org 15->35 41 2 other IPs or domains 15->41 21 dw20.exe 2 7 15->21         started        37 checkip.dyndns.com 132.226.247.73, 49701, 80 UTMEMUS United States 18->37 39 checkip.dyndns.org 18->39 43 2 other IPs or domains 18->43 53 May check the online IP address of the machine 18->53 23 dw20.exe 22 6 18->23         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 19:48:11 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=smtjjmoqu5pficcoe4pgpqn7r7mhvkejx5oycn53c3h2n6d3j4ka._file
Verdict:
malicious
Similar samples:
022e918d8b07b6bda3fc703e212db5d145fa5814f33ea2fa8a350e2be405a348
SnakeKeylogger
12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4
SnakeKeylogger
19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2
SnakeKeylogger
1b7416ccd14d77c3e32acd8de94d7a3e41d7c615ce2fe04ab9254025fade1464
SnakeKeylogger
25449e29a38dc9c7b102b263b6c076a8b45ac2d2149c336ed9c885cd41905a8c
SnakeKeylogger
42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81
SnakeKeylogger
83fef9d67405ca7975e04fc8c66e7d298809f90260d1b287f709a3bae49f502e
SnakeKeylogger
ab74bc0055021acfabe6b05c55f5dd39ba805c770825ca887c1ac6c135f4bd99
SnakeKeylogger
b3139cd800107b9fe4d5bef34bbb21281c8a4432adb990be5f4e99c3df3a86eb
SnakeKeylogger
c751f9d546d20216bdc996ecdcea6ee9f57771682879383621bff83a8229e384
SnakeKeylogger
+ 4'730 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/221101-ysn36afebk/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Gathering data
Unpacked files
SH256 hash:
049a3787d59652f29e40d7882abac625fded66dd5a20f61060e6910515a019f7
MD5 hash:
dbb8c873ebb0a95e9f7c83b5d68d6579
SHA1 hash:
ffd776a2b0cd82835f437a41602cd403823140db
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/108dc999-67a6-4dc6-9a86-90ae313e2be8/
Parent samples :
932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14
6379623552f5d0965d8cfe83f3725942907a9b26766e3e6cb5e27258b1e120d9
SH256 hash:
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 hash:
56a321bd011112ec5d8a32b2f6fd3231
SHA1 hash:
df20e3a35a1636de64df5290ae5e4e7572447f78
Link:
https://www.unpac.me/results/108dc999-67a6-4dc6-9a86-90ae313e2be8/
SH256 hash:
932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14
MD5 hash:
87817dff8804ac16744cc5bfc8e922b1
SHA1 hash:
fbee28c86835f0a8f702e5e84a480cc254df99d7
Link:
https://www.unpac.me/results/108dc999-67a6-4dc6-9a86-90ae313e2be8/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/932694b1d0a7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Choice_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_KB_ID_Infostealer
Create hunting rule
Author:ditekshen
Description:Detects exfiltration email addresses correlated from various infostealers. The same email may be observed in multiple families.
Reference:https://github.com/ditekshen/is-wos
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_bot_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/326906/

Comments