MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1
SHA3-384 hash: b6de2e04e5e162e1949890224c2786d08d0da467d6fd4306e165ad414fbf880e8769bc4470ca366fb87f88225397c23b
SHA1 hash: dfba0231d1991f3f4e702d44a4c90598b99a2e9b
MD5 hash: e44aa3fc8915966c0164277654982012
humanhash: comet-grey-mountain-august
File name:Payment_Draft_confirmation.xla
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:55'808 bytes
First seen:2024-03-20 07:10:19 UTC
Last seen:2024-03-20 08:27:43 UTC
File type:Excel file xlsx
MIME type:application/vnd.ms-excel
ssdeep 1536:YfC6TgCDsbumqwQgjWq55xWEHUYutA8dK5Lg:YfCDOsbfqwvWZYuLd
TLSH T1DC43CF1432E8D426C093ADBE8CC4C1DBA7543C64ED428B4F35C17B1E253D6D2AA57B6A
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:SnakeKeylogger xla xlsx

Intelligence

File Origin
# of uploads :
2
# of downloads :
584
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1.xlsx
Verdict:
Suspicious activity
Analysis date:
2024-03-20 07:55:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e906c891-51c3-434f-9fb1-251bb642038e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/octet-stream
Has a screenshot:
False
Contains macros:
False
Detection(s):
Sanesecurity.Badmacro.Xls.VB.Redir1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Changing an executable file
Using the Windows Management Instrumentation requests
Creating a window
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Creating a file
Connection attempt
Sending a custom TCP request
Creating a file in the %AppData% directory
Creating a process with a hidden window
Possible injection to a system process
Connection attempt by exploiting the app vulnerability
Launching a process by exploiting the app vulnerability
Creating a process from a recently created file
Launching a file downloaded from the Internet
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1/results/dashboard
Payload URLs
URL
File name
http://qly.ai/TZWGK
Embedded Ole
Behaviour
SuspiciousRTF detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embedequation exploit macros masquerade shellcode sload
Link:
https://www.filescan.io/uploads/65fa8c09757c624818b3a0f7/reports/69d1ef35-13c3-4c8d-b255-4a9a96390ec8/overview
Verdict:
Suspicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1
Label:
Benign
Suspicious Score:
4.4/10
Score Malicious:
45%
Score Benign:
55%
Link:
https://www.malware.ai/gui/files/?id=274e1c41-9a4d-4b08-8ff3-bdca0d65c277
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1412174
Signature
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Creates autostart registry keys with suspicious values (likely registry only malware)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Found malware configuration
Injects a PE file into a foreign processes
Installs new ROOT certificates
Malicious sample detected (through community Yara rule)
Microsoft Office drops suspicious files
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: Equation Editor Network Connection
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell download and load assembly
Sigma detected: Powershell download payload from hardcoded c2 list
Sigma detected: RegAsm connects to smtp port
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Yara detected Powershell download and execute
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1412174 Sample: Payment_Draft_confirmation.... Startdate: 20/03/2024 Architecture: WINDOWS Score: 100 56 qly.ai 2->56 82 Multi AV Scanner detection for domain / URL 2->82 84 Found malware configuration 2->84 86 Malicious sample detected (through community Yara rule) 2->86 88 22 other signatures 2->88 10 EXCEL.EXE 53 41 2->10         started        14 wscript.exe 2->14         started        17 wscript.exe 2->17         started        signatures3 process4 dnsIp5 70 qly.ai 144.126.217.83, 49163, 49165, 49166 LOYOLAUS United States 10->70 72 207.32.219.82, 49164, 49167, 49169 1GSERVERSUS United States 10->72 50 snkisanewthingswhi...whathetoldme[1].doc, Rich 10->50 dropped 19 wscript.exe 11 10->19         started        23 WINWORD.EXE 345 37 10->23         started        118 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->118 file6 signatures7 process8 dnsIp9 58 paste.ee 19->58 60 172.67.187.200, 443, 49171 CLOUDFLARENETUS United States 19->60 90 System process connects to network (likely due to code injection or exploit) 19->90 92 Suspicious powershell command line found 19->92 94 Wscript starts Powershell (via cmd or directly) 19->94 104 5 other signatures 19->104 26 powershell.exe 4 19->26         started        62 qly.ai 23->62 42 C:\Users\user\AppData\Roaming\...\qly.ai.url, MS 23->42 dropped 44 C:\Users\user\AppData\Roaming\...\TZWGK.url, MS 23->44 dropped 46 ~WRF{CC73FC16-3146...A-73D0B7D9CFCF}.tmp, Composite 23->46 dropped 48 C:\Users\user\AppData\Local\...6F17E6F.doc, Rich 23->48 dropped 96 Microsoft Office launches external ms-search protocol handler (WebDAV) 23->96 98 Office viewer loads remote template 23->98 100 Microsoft Office drops suspicious files 23->100 29 EQNEDT32.EXE 12 23->29         started        file10 102 Connects to a pastebin service (likely for C&C) 58->102 signatures11 process12 file13 110 Suspicious powershell command line found 26->110 112 Suspicious execution chain found 26->112 32 powershell.exe 13 6 26->32         started        52 C:\Users\user\...\imaginepixelkissing.vbs, Unicode 29->52 dropped 114 Office equation editor establishes network connection 29->114 116 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 29->116 signatures14 process15 dnsIp16 54 uploaddeimagens.com.br 104.21.45.138, 443, 49172, 49173 CLOUDFLARENETUS United States 32->54 74 Suspicious powershell command line found 32->74 76 Creates autostart registry keys with suspicious values (likely registry only malware) 32->76 78 Writes to foreign memory regions 32->78 80 Injects a PE file into a foreign processes 32->80 36 RegAsm.exe 12 2 32->36         started        40 powershell.exe 5 32->40         started        signatures17 process18 dnsIp19 64 mail.lub-rref.com 36->64 66 checkip.dyndns.org 36->66 68 6 other IPs or domains 36->68 106 Tries to steal Mail credentials (via file / registry access) 36->106 108 Tries to harvest and steal browser information (history, passwords, etc) 36->108 signatures20
Detection:
cve-2017-11882-shellcode
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1/
Threat name:
Document-Excel.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-03-20 03:51:10 UTC
File Type:
Document
Extracted files:
34
AV detection:
8 of 37 (21.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tsxk56s6zniirfp66sdwjxdit5e53cwz67sn5hsseaxryhnrahqq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/240320-hzym6sbd26/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
outlook_office_path
outlook_win_path
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Abuses OpenXML format to download file from external location
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
Snake Keylogger
Snake Keylogger payload
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9caeaefa5ecb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9caeaefa5ecb508895fef48764dc689f49dd8ad9f7e4de9e52202f1c1db101e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments