MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98a53af9d196562466ac85faa2c1c4c62d4646f9c3e1040df4396e08adbe3a1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98a53af9d196562466ac85faa2c1c4c62d4646f9c3e1040df4396e08adbe3a1f
SHA3-384 hash: db5a6eb7464ac1ae960b7e89eb661a248e9b6e3dea5c20b154715a2c5435cf5f3e7c0553df88edb0c2b8acb49135f21b
SHA1 hash: 14a571cba41ae7893ec4435806604237cc80c373
MD5 hash: b8b17a24058b530649a6caea020a2abf
humanhash: snake-steak-zulu-nitrogen
File name:Telex Transfer.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:694'784 bytes
First seen:2021-02-24 06:30:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:eFxQ/8mNk0hb6vM3TSXyeIkR+F0hhNWXHS8JCtOJIvWhgYIdQzY:eCLhpTSieIk+F0h2wtOJIegY2x
Threatray 14 similar samples on MalwareBazaar
TLSH 4FE49E2432845B6EF43EFB3AA505140FA3F9BA47C756CA8B7D8981CF1C26E448795F12
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: vps.tecp0s.com
Sending IP: 203.159.80.121
From: office1@tecp0s.com
Subject: TELEX TRANSFER
Attachment: Telex Transfer.gz (contains "Telex Transfer.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Telex Transfer.exe
Verdict:
Malicious activity
Analysis date:
2021-02-24 06:33:24 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/021c99b5-114e-4dc9-98b4-b01f377e03c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118799/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/616514
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Found malware configuration
Injects a PE file into a foreign processes
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98a53af9d196562466ac85faa2c1c4c62d4646f9c3e1040df4396e08adbe3a1f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 01:15:07 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcstv6orszlcizvmqx5kfqoeyywumrxzypqqidpuhfxarln6hipq._file
Verdict:
unknown
Similar samples:
09590e393fa08d0c6f99e9f5df1235c700e53f48f0c0941ed1a4a5e4035a5624
SnakeKeylogger
3940236a6147e6a6642202e416a956d61cd41f709439075a99aa290767f55d8c
SnakeKeylogger
611a8fd6a437109e323043d6bbc020260317969a34b74e3237c880f2a7da7bf5
SnakeKeylogger
6e027a958577efeae259befdc9aabf5656088885342e896673d005e748367743
SnakeKeylogger
a922d6a65dd738d1c715a254a2e257b1c35b006052ee426f634558f11db91d5b
SnakeKeylogger
ae1bb452d80ac991a91861b13755c4f5c13b006c714cddcc5e03ae7263092e01
SnakeKeylogger
bc88c73fda9a2ef51f979d2368a1039a04a0ce8199dc46b9f992a9ffacf58d8c
SnakeKeylogger
c8c864915e84ba7ec98eed5ed70893bcb5b328e59751694595a71b303ea587aa
SnakeKeylogger
cd92e28557e13a857a9166209afd4f5e64f477e25a4189904f54063b69847013
SnakeKeylogger
fc3b3ec5757f584d1fe42cbba44a0cc2f70e11f02811a074b05003230e8cb657
SnakeKeylogger
+ 4 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210224-pyy5w6efen/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
e624003658c4f8b349f567c82229fd15d1e63d3d20fe6f7b4388403038cd2a44
MD5 hash:
b6ce7c1d81b9271eab825ea63de154c3
SHA1 hash:
0e7b89555314f8908c1098b652c9bf50e5ecc27b
Link:
https://www.unpac.me/results/8a2f77d0-77d3-4bff-8c21-0dd4bc891814/
SH256 hash:
98a53af9d196562466ac85faa2c1c4c62d4646f9c3e1040df4396e08adbe3a1f
MD5 hash:
b8b17a24058b530649a6caea020a2abf
SHA1 hash:
14a571cba41ae7893ec4435806604237cc80c373
Link:
https://www.unpac.me/results/8a2f77d0-77d3-4bff-8c21-0dd4bc891814/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz e0f674131dcd9ede13f24a179b2d6dda32f8c70353a49fee544571bd271cce75

SnakeKeylogger

Executable exe 98a53af9d196562466ac85faa2c1c4c62d4646f9c3e1040df4396e08adbe3a1f

(this sample)

  
Dropped by
MD5 17e009059e769439a5e74d4111c9421e
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e0f674131dcd9ede13f24a179b2d6dda32f8c70353a49fee544571bd271cce75
Cape
Cape
https://www.capesandbox.com/analysis/118799/

Comments