MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 949bad408e6b2dc0f53c4799a7a451e49ac2e28695eb18c72f62ea6628b32188. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	949bad408e6b2dc0f53c4799a7a451e49ac2e28695eb18c72f62ea6628b32188
SHA3-384 hash:	a176742c37180d2e23f58536bc54b1908fd85a29b4457f0f09af162558a36e959e8fbd29761383eb86eb7deeab32171d
SHA1 hash:	bb9fcb8c15c0bd9842d4d60175448645fbfe7d89
MD5 hash:	d7e4e78c622f068533f7a14d788ff361
humanhash:	vegan-october-nitrogen-whiskey
File name:	aralık---- ekstrenizz.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	459'776 bytes
First seen:	2020-12-22 07:12:37 UTC
Last seen:	2020-12-22 08:46:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	6268f04e234d87c0f6d247f77774934b (3 x SnakeKeylogger, 1 x Formbook)
ssdeep	6144:ohcCLBFBMjfKMSI2ywpxA9qAKHwkQysPVh9/eqpm2q0gVbDCRyG7G1+8Ky1SG2f:LCLB+qIzdKH72xo2q0W3CRymG1Kyg9
Threatray	118 similar samples on MalwareBazaar
TLSH	30A412C05A25CB46FA80173C82D92771CF317D46BEA710EFD4A0FAA32A675CA41E167D
Reporter	abuse_ch
Tags:	exe geo SnakeKeylogger TUR

abuse_ch

Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: ekstre@eekstre.qnbfinansbank.com
Subject: CardFinans KOBİ Visa Aralık ayi ekstreniz.
Attachment: ekstrenizz.7z (contains "aralık---- ekstrenizz.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

306

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/108657/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader36.29908.2304.26861.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a file

Running batch commands

Launching a process

DNS request

Sending an HTTP GET request

Sending a UDP request

Sending a custom TCP request

Reading critical registry keys

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Gathering data

Result

Threat name:

AgentTesla Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/567951

Signature

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/949bad408e6b2dc0f53c4799a7a451e49ac2e28695eb18c72f62ea6628b32188/

Threat name:

Win32.Trojan.Zusy

Status:

Malicious

First seen:

2020-12-21 09:20:40 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ssn22qeonmw4b5j4i6m2pjcr4snmfyugsxvrrrzpmlvgmkftegea._file

Verdict:

unknown

SnakeKeylogger

07241205f3395c084fe0aeb0f6250d249e050aeea4a916e753a62c51a92d9d21

SnakeKeylogger

12b509bfe3cba6cce7ceea96bae600e12cee4c7fbd55f6fb3ac8a93b7cf122dd

SnakeKeylogger

50b4aec831a717654b19c4130dd0187354d47a932e8f7b1878f931132223a1ef

SnakeKeylogger

5c03cc9cabc0adbcdb1597650f9fc5dd5c3b338a0e8558887a02fbb3be8c34c4

SnakeKeylogger

8c3f5afea73a61ecc6e171418e7099e336e8e5eeed9ed5bb3aaf104bc3bb53aa

SnakeKeylogger

9b35dc0bcb0baf3eba77e1852d5e9836c7e9260f094b9df0db096dc7dbf0d4bc

SnakeKeylogger

b782f5827c8728175d0bd243414a50b69f2707d5c7902719fd49d189ee2bf986

SnakeKeylogger

cdfc1600f7f5656fb2b72fd10da44b8f7e12f4c40027a4338251e5d7e9f0e743

SnakeKeylogger

d6a2dd4ed732f43100bcf66aa1bbef9442c4ed975d943ee81c99c3fa4932d91c

SnakeKeylogger

+ 108 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/201222-gf6jwj29pe/

Behaviour

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Looks up external IP address via web service

Unpacked files

SH256 hash:

5ddcc7ed95d9f35583a72cd0b597443579536254e4067b692fb26fdf0dd29ae9

MD5 hash:

581ff57fde5cdbd7a02ee70c9e6ce701

SHA1 hash:

bede6759d9155ea51142ccb3e8695702b5b2e883

Link:

https://www.unpac.me/results/920e260b-dd77-4e2f-b281-d51f5587e696/

SH256 hash:

949bad408e6b2dc0f53c4799a7a451e49ac2e28695eb18c72f62ea6628b32188

MD5 hash:

d7e4e78c622f068533f7a14d788ff361

SHA1 hash:

bb9fcb8c15c0bd9842d4d60175448645fbfe7d89

Link:

https://www.unpac.me/results/920e260b-dd77-4e2f-b281-d51f5587e696/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Jaik

Score:

0.40

Link:

https://yomi.yoroi.company/submissions/949bad408e6b2dc0f53c4799a7a451e49ac2e28695eb18c72f62ea6628b32188

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector