MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bb2fd0c495cb25088038f5b81e91ad8f893d9a6d799bc685227062f083f4667. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bb2fd0c495cb25088038f5b81e91ad8f893d9a6d799bc685227062f083f4667
SHA3-384 hash: 4260661bf15aede16fe274dc5eff12e3a2fcc6892b545cebe4b2cd8db3c9c40268d0deffa83b097cbf3d96ff036d0e14
SHA1 hash: 83a844f35cbe81f5234803d867046ff21b8c5a99
MD5 hash: f6c552e1a2d895d55425cdf55ca04427
humanhash: dakota-william-missouri-florida
File name:RFQ 100400806 SUPPLY.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:716'288 bytes
First seen:2021-04-06 08:17:35 UTC
Last seen:2021-04-06 13:05:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:m2iNT19oO95jtyILFIB/6sT4in0fMyaKLpTxiF33v9TKpIp5Wl/K42BL:m15RII2h6g4ijyaL3lTKpd/o
Threatray 8 similar samples on MalwareBazaar
TLSH 8AE41261B305EB81C47947B298A391438775F1E93427DFA00E59A1D9312EF4CACE9EE3
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.good-hills.co.jp
Sending IP: 153.120.2.71
From: ahmad.khalil<mouhanaestryd@awalnet.net.sa>
Reply-To: gk@aquaflor.ae
Subject: TENDER/BID OIL AND GAS TOOLS ADNOC PROJECT ABU DUBAI
Attachment: RFQ 100400806 SUPPLY.rar (contains "RFQ 100400806 SUPPLY.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ 100400806 SUPPLY.exe
Verdict:
Malicious activity
Analysis date:
2021-04-06 08:38:13 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/ffc18cb1-b5dc-457e-bfea-4bd69a0b4dbe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/132620/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/667358
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9bb2fd0c495cb25088038f5b81e91ad8f893d9a6d799bc685227062f083f4667/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 05:21:19 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tozp2dcjlszfbcadr5nyd2i23d4jhwng26m3y2cse4dc6cb7iztq._file
Verdict:
unknown
Similar samples:
1ef7984487fc42d24d095dece8749226ca420e33da25106a6ad1915a6f082a8b
SnakeKeylogger
2534d4d9d35acd53aacf73d734a158e8cfd12c9e6a3d3527f2fb1e2dbf5a487d
SnakeKeylogger
53cd9651cbdd09d3f06b909017df029bf51ff781bce199fe823ca8cb78b3e75e
SnakeKeylogger
79ffad444c6c77834dd38dc5aba56cad7006d815b7a101d6ab9a5f6f881fbb1d
SnakeKeylogger
8434177ad88b9dae32c1af3253dd5cbda0bfa994d3bb6fcdda659679ae822228
SnakeKeylogger
9b3c0d0fcfba031b1c667d8e990940265571bbb77a879317684f6747e0a3e969
SnakeKeylogger
ae7d14d604ceb767afe056f099002dba0741eaf6e0ad49ce1f7b403b522b9862
SnakeKeylogger
eed201f6b8c3196b4389e553c12dc2a298dbe1e6decefc94873a25560d71365c
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210406-d1s2dvrf5s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
04c848277f9f54101bff60e159ac3ef0152ada624b942026b3cdf04a5a16188e
MD5 hash:
4cbe95bef5ebb49b14da37dba05e3f4b
SHA1 hash:
de485b3d18c82890dc07f268653075c89fb92761
Link:
https://www.unpac.me/results/67922337-c90e-42a4-b184-3a5458a9f07f/
SH256 hash:
84d96624c0105d022fb1c39bd407d47d2a6ac3ae841318c361805036b43e2324
MD5 hash:
4688091d973b6247436d136fae085d89
SHA1 hash:
d9b10dd52b7ffabbbe7d25c52873220f547fbd6a
Link:
https://www.unpac.me/results/67922337-c90e-42a4-b184-3a5458a9f07f/
SH256 hash:
fdccaed76f7279e6b8cc1579dadeed03fa1b8d1adcdfbcac585a68da168366d5
MD5 hash:
8b603b23caf00139206f293eb741a9f0
SHA1 hash:
1cc90aec7ce07b13930fe0c088fe3cd155b3ea07
Link:
https://www.unpac.me/results/67922337-c90e-42a4-b184-3a5458a9f07f/
SH256 hash:
9bb2fd0c495cb25088038f5b81e91ad8f893d9a6d799bc685227062f083f4667
MD5 hash:
f6c552e1a2d895d55425cdf55ca04427
SHA1 hash:
83a844f35cbe81f5234803d867046ff21b8c5a99
Link:
https://www.unpac.me/results/67922337-c90e-42a4-b184-3a5458a9f07f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9bb2fd0c495cb25088038f5b81e91ad8f893d9a6d799bc685227062f083f4667

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 26438ced80fef561bc572ae26c081c2a6ee78f4065bf37b1085a95314366aa18

SnakeKeylogger

Executable exe 9bb2fd0c495cb25088038f5b81e91ad8f893d9a6d799bc685227062f083f4667

(this sample)

  
Dropped by
MD5 951ba89cf95cd3cd0780a6b285109258
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/132620/
  
Dropped by
SHA256 26438ced80fef561bc572ae26c081c2a6ee78f4065bf37b1085a95314366aa18

Comments