MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef
SHA3-384 hash: 9fa85627c3320b7ff0968b6b87df10c0a013a3220fcd81c0d2f22bea25e697e001b4549ea54b9f8776918db8b18b8fb0
SHA1 hash: a205fc631e9bef272a99fe3d5368b57a686cf4d9
MD5 hash: c569946f2ea5bd451796c0d9deb5c231
humanhash: lithium-bacon-october-snake
File name:PURCHASE_ORDER_N_83194.IMG.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:596'480 bytes
First seen:2021-02-02 15:51:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:DqeuO2yTKI5/DX85JopCqfGgTOY1S2AxVEYYCDalpT/ZglmQWYVbBFWbXP4GR2D:Dq+eI5/DM5Jj4cm8Bdalp1sBVbvWf4D
Threatray 12 similar samples on MalwareBazaar
TLSH 94C4AFB9E4028FA6C5D91B7A9B61362073F071B3A752C15F609031BF2A45BD488F3D6B
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rslog.com.cn
Sending IP: 103.99.1.142
From: resleypeng.sh@rslog.com.cn
Subject: Fwd: Purchase Order n° 831947 / DLB026
Attachment: PURCHASE_ORDER_N_83194.IMG.rar (contains "PURCHASE_ORDER_N_83194.IMG.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115178/
Detection(s):
Porcupine.MSIL.Kryptik.ZMW.99546.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Sending a UDP request
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/596860
Signature
Allocates memory in foreign processes
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 11:54:47 UTC
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s4vogvs4ew73l76fznumu7y6eklei2umophwasm4r67j4xy5kxxq._file
Verdict:
unknown
Similar samples:
0c3d1e60a1f6caa8bc2c84704ccf93ff2096891b6b5693952f5417c5aa577ee1
SnakeKeylogger
12f55950dc52aa9e607fcc04d3d2d2a58689a7ad8c1adbf58d04ac0c452ed5c0
SnakeKeylogger
137fb0e24fd529a653dc39073e216fc0044ba9ddbb1515d34155b16f9848ce1f
SnakeKeylogger
15e8538add4ab2c08d4706205118a0ed7cd9c969d030f8b9ca203a12b0623c78
SnakeKeylogger
484f0ef144b32492e7e9fe36e92b69b336583fa925438d2e82409006dd534af7
SnakeKeylogger
69b3daa0773330e2607a293d7e268f6360c74f1a446a803944a00c8cd5162527
SnakeKeylogger
a8aad152f516add6a277e2634baa324b105a90c3b02935aa2fa11ea4f0c4667e
SnakeKeylogger
d15fa8ff467270abc9ba8c36038c455d2ad1de137748a1cc886e5f148a3a3fd8
SnakeKeylogger
ee2d3399e07c48849e8df4415f583db278466f880353b26a5e66b03f99185af6
SnakeKeylogger
ef715cd322f0a805a68840b215c062f2e254977170a11c6800d836eac781fabb
SnakeKeylogger
+ 2 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210202-461g6h96qx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Beds Protector Packer
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
4ccb7c51f9e026911f7beb73e01ce4d120184ce92b2b302955246dd1c2fff7ac
MD5 hash:
bbb47d52b0dd86930646e98825df243f
SHA1 hash:
fe2c851d6dee63cf8bb9eb3845f580bf02f7c481
Link:
https://www.unpac.me/results/ce0b85a6-f512-4f68-b6c3-fee071761c4a/
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/ce0b85a6-f512-4f68-b6c3-fee071761c4a/
SH256 hash:
65e86b41bc4952187a236e30e9455f5b571be1d757ef2d34428a81eb3822f54c
MD5 hash:
ce4ed80eb4c79525012a5cbe7c94659e
SHA1 hash:
ca4a16d9011f0bae1041aa06d3cc1779ee5032c3
Link:
https://www.unpac.me/results/ce0b85a6-f512-4f68-b6c3-fee071761c4a/
SH256 hash:
972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef
MD5 hash:
c569946f2ea5bd451796c0d9deb5c231
SHA1 hash:
a205fc631e9bef272a99fe3d5368b57a686cf4d9
Link:
https://www.unpac.me/results/ce0b85a6-f512-4f68-b6c3-fee071761c4a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 2ef66476dfed0997ef72acffb86091b0fe3fddcd9e4696b74472293f62af676e

SnakeKeylogger

Executable exe 972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef

(this sample)

  
Dropped by
MD5 66d9d2008a8eb5b787456609ef28a98b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/115178/
  
Dropped by
SHA256 2ef66476dfed0997ef72acffb86091b0fe3fddcd9e4696b74472293f62af676e

Comments