MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cb54681b585020ef5deef74c4fc2772529d1d0a908e5da4afa751368779aba1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cb54681b585020ef5deef74c4fc2772529d1d0a908e5da4afa751368779aba1
SHA3-384 hash: 859f30f38dac8cdb884616069aaea93bcb1ceb8e2353c033c06a259828f402e5c4bae46986f0966e8f9cf606185c039c
SHA1 hash: 2ceb0743bb87dcf356594dce6d80729b9f813f9f
MD5 hash: eac5c6f21e77b72411042ffa77a1e518
humanhash: spring-texas-enemy-nine
File name:Minutes of Meeting.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'056'256 bytes
First seen:2021-06-23 05:18:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:FwvWFHmVdFWaROEbS7WyxQM9i/5O32THEP7Go0j4IrUStSQipP5i:FJHZEbqW1f/5OGTEP7GoW/rLips
Threatray 502 similar samples on MalwareBazaar
TLSH FC25CF220ECF422AE2755FB557B0BC8382B6ADB62705A2213DC031ADDA335DADDDF511
Reporter cocaman
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Minutes of Meeting.exe
Verdict:
Malicious activity
Analysis date:
2021-06-23 05:19:16 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/8a6eaa83-459c-4ab7-b265-bdff636ad4d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167722/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader39.59262.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/21cc23b2-168b-4b53-bca5-8b0278fe1df3
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806373
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected AntiVM3
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cb54681b585020ef5deef74c4fc2772529d1d0a908e5da4afa751368779aba1/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 22:14:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ts2unanvquba55o6552mj7bhojjj2hikschf3jfpu5itnb3zvoqq._file
Verdict:
unknown
Similar samples:
1bffa62ec8cfff47103c41ff3de5a5f0c887c9958460d9f4ec00f5886d2a5d20
SnakeKeylogger
2b0002d2114e4a6c46b82c8a3e12f939d5b5ccc588e33a6b70238db5abc751bb
SnakeKeylogger
473ec4f2b7a198ff36e66b86cbc05848883b4dffeaacb8b9c97e67e88e977986
SnakeKeylogger
55c05e011a2ed69bb4c04240820f50c433ffcda3d0792ea25c7cd272322112d8
SnakeKeylogger
7e07c98e0f97b46db236ef8765108ce7bb484e29dab1da0924de402ff3b84bdd
SnakeKeylogger
b85e4c358cd20b0ad6e0bcdb93e578ee2dc2a898cfa60da1f39be1ea8424ce92
SnakeKeylogger
c3563e777c01c0ea26f7a8f26e598dacd68d096966011da76a5311f09ba21614
SnakeKeylogger
c69f392d73ffa5b09d2ea03cefd8e5e7d9a490ef819468db9409bd9988e26c54
SnakeKeylogger
d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b
SnakeKeylogger
ef7a3dbe8ef34849ff464fc0b796d637cf798c7d689fa8aaf294bf8ce414ba69
SnakeKeylogger
+ 492 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210623-5rn3lffwh6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
c8e24086477d1c49ca75b6fade750f4039bf5872bcbfa0e3565619e7efc4144d
MD5 hash:
ade5e014addb083cc114db436867018c
SHA1 hash:
e1a19814761a4761c604be37e4b47d5d59349cda
Link:
https://www.unpac.me/results/3ab22d18-acbf-47ba-843f-c4401629c486/
SH256 hash:
64cf9ccfd0c499d0d088e02888030e54159c3755513faed6fa20d6e04dab3837
MD5 hash:
68677a35bcb3aa1fe31017c110e506ab
SHA1 hash:
c97393af1a8454bf914c53f8710e53b828805803
Link:
https://www.unpac.me/results/3ab22d18-acbf-47ba-843f-c4401629c486/
SH256 hash:
e2539e6f36011b2dc285d1e664be2eed3ae313b6eac30f389eac6fabadfa64c8
MD5 hash:
994896b1c8129ecc3e4765c45c8a4238
SHA1 hash:
3fe89648a1f19c037eb50f40c7d6b1da6cc51675
Link:
https://www.unpac.me/results/3ab22d18-acbf-47ba-843f-c4401629c486/
SH256 hash:
9cb54681b585020ef5deef74c4fc2772529d1d0a908e5da4afa751368779aba1
MD5 hash:
eac5c6f21e77b72411042ffa77a1e518
SHA1 hash:
2ceb0743bb87dcf356594dce6d80729b9f813f9f
Link:
https://www.unpac.me/results/3ab22d18-acbf-47ba-843f-c4401629c486/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/9cb54681b585020ef5deef74c4fc2772529d1d0a908e5da4afa751368779aba1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

r00 c3773b3eec40de054099cab333c06b4502b9343aae95ee7d3120d42fb12bfd46

SnakeKeylogger

Executable exe 9cb54681b585020ef5deef74c4fc2772529d1d0a908e5da4afa751368779aba1

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c3773b3eec40de054099cab333c06b4502b9343aae95ee7d3120d42fb12bfd46
Cape
Cape
https://www.capesandbox.com/analysis/167722/

Comments