MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020
SHA3-384 hash: 75edb2648e9ebe47e904e1ad0586a3944a21affc500dc2b77575b42455a9697dc5aa60cd8b3a4c3625ff80f518ed2b5a
SHA1 hash: b04d798d1375c242273fd6a1d8553b9312663668
MD5 hash: 8aeb2829342f8bb9acb171472da1d64e
humanhash: romeo-venus-saturn-asparagus
File name:snakey.bin
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'316'864 bytes
First seen:2023-04-04 18:16:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:TSqyyAztDE0S4F0fVKpTKVWk/zV97HRsL9ve0EJxFL/kG:TMZEf4F0fVGJ2LxsL9ve04
Threatray 69 similar samples on MalwareBazaar
TLSH T16755232F71248F25CB3AE3BAE043A04D43F194B7307AE7995DCA2DD18D2732599A3553
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter RussianPanda95
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
qbOdWSNNuqquo2E.exe
Verdict:
Malicious activity
Analysis date:
2023-04-04 08:40:26 UTC
Tags:
installer snake keylogger trojan evasion
Link:
https://app.any.run/tasks/99de6280-dd65-4b70-8b60-9c9592067601

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/380114/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.10051.12933.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/642c699f05c72da113b374e5/reports/649bf0f8-d01e-4931-8974-8800fd06af4a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/09d6315d-8e87-455d-96cb-e127cf7136ed
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1208290
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Drops PE files to the document folder of the user
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 841205 Sample: snakey.bin.exe Startdate: 04/04/2023 Architecture: WINDOWS Score: 100 99 checkip.dyndns.org 2->99 101 checkip.dyndns.com 2->101 103 2 other IPs or domains 2->103 131 Snort IDS alert for network traffic 2->131 133 Multi AV Scanner detection for domain / URL 2->133 135 Malicious sample detected (through community Yara rule) 2->135 137 12 other signatures 2->137 10 snakey.bin.exe 7 2->10         started        14 Synaptics.exe 2->14         started        16 bRBgyCtm.exe 5 2->16         started        18 2 other processes 2->18 signatures3 process4 file5 91 C:\Users\user\AppData\Roaming\bRBgyCtm.exe, PE32 10->91 dropped 93 C:\Users\...\bRBgyCtm.exe:Zone.Identifier, ASCII 10->93 dropped 95 C:\Users\user\AppData\Local\...\tmpD3C7.tmp, XML 10->95 dropped 97 C:\Users\user\AppData\...\snakey.bin.exe.log, ASCII 10->97 dropped 155 Uses schtasks.exe or at.exe to add and modify task schedules 10->155 157 Adds a directory exclusion to Windows Defender 10->157 159 Injects a PE file into a foreign processes 10->159 20 snakey.bin.exe 1 5 10->20         started        23 powershell.exe 19 10->23         started        25 schtasks.exe 1 10->25         started        27 Synaptics.exe 14->27         started        29 schtasks.exe 14->29         started        161 Multi AV Scanner detection for dropped file 16->161 163 Machine Learning detection for dropped file 16->163 31 bRBgyCtm.exe 16->31         started        33 schtasks.exe 16->33         started        signatures6 process7 file8 73 C:\Users\user\...\._cache_snakey.bin.exe, PE32 20->73 dropped 75 C:\ProgramData\Synaptics\Synaptics.exe, PE32 20->75 dropped 77 C:\...\Synaptics.exe:Zone.Identifier, ASCII 20->77 dropped 35 Synaptics.exe 20->35         started        38 ._cache_snakey.bin.exe 15 2 20->38         started        41 conhost.exe 23->41         started        43 conhost.exe 25->43         started        79 C:\ProgramData\...\._cache_Synaptics.exe, PE32 27->79 dropped 45 ._cache_Synaptics.exe 27->45         started        47 conhost.exe 29->47         started        81 C:\Users\user\...\._cache_bRBgyCtm.exe, PE32 31->81 dropped 49 ._cache_bRBgyCtm.exe 31->49         started        51 Synaptics.exe 31->51         started        53 conhost.exe 33->53         started        process9 dnsIp10 139 Multi AV Scanner detection for dropped file 35->139 141 Drops PE files to the document folder of the user 35->141 143 Machine Learning detection for dropped file 35->143 145 Adds a directory exclusion to Windows Defender 35->145 55 Synaptics.exe 35->55         started        59 powershell.exe 35->59         started        61 schtasks.exe 35->61         started        105 checkip.dyndns.com 193.122.130.0, 49701, 49702, 49749 ORACLE-BMC-31898US United States 38->105 107 checkip.dyndns.org 38->107 109 192.168.2.1 unknown unknown 38->109 111 checkip.dyndns.org 45->111 147 Antivirus detection for dropped file 45->147 149 May check the online IP address of the machine 45->149 151 Tries to steal Mail credentials (via file / registry access) 45->151 153 2 other signatures 45->153 signatures11 process12 dnsIp13 113 docs.google.com 142.251.36.206, 443, 49705, 49706 GOOGLEUS United States 55->113 115 freedns.afraid.org 69.42.215.252, 49707, 49761, 80 AWKNET-LLCUS United States 55->115 117 xred.mooo.com 55->117 83 C:\Users\user\Downloads\ChromeSetup.exe, PE32 55->83 dropped 85 C:\Users\user\Documents\~$cache1, PE32 55->85 dropped 87 C:\Users\user\Desktop\._cache_Synaptics.exe, PE32 55->87 dropped 89 8 other malicious files 55->89 dropped 63 ._cache_Synaptics.exe 55->63         started        67 WerFault.exe 55->67         started        69 conhost.exe 59->69         started        71 conhost.exe 61->71         started        file14 process15 dnsIp16 119 checkip.dyndns.org 63->119 121 checkip.dyndns.com 63->121 123 Antivirus detection for dropped file 63->123 125 Multi AV Scanner detection for dropped file 63->125 127 May check the online IP address of the machine 63->127 129 2 other signatures 63->129 signatures17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020/
Threat name:
Win32.Trojan.SnakeStealer
Create hunting rule
Status:
Malicious
First seen:
2023-04-04 07:35:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tudbri5gaj7up26ylijgo4hin436nzd3gxzboxt73yykz4oxgaqa._file
Verdict:
malicious
Similar samples:
0369aa99d731d2de260bc63b6c4f85d997eb189155c362df478d8f5afaa655b0
SnakeKeylogger
98f57a58e8c04c7905cd96329487ea551f61ec1265d991f502fe7413254def12
SnakeKeylogger
a49f6e00c0468e074fa2204a7862c22aa3b934af4f2bb281c55d8bb65da67e44
SnakeKeylogger
c1aa3e19aaa042198af892f216f9f32bc506249c499ac2a31e71f012fce68f97
SnakeKeylogger
cf3d069794498e9ee621651afdc6823dd2b076789af668f296f7ff9a233d1c3d
SnakeKeylogger
dc89fb6fea674bafdb5f7945ece7ba57090647996caee4fd06e7f2a4c20fe4ea
SnakeKeylogger
e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a
SnakeKeylogger
fe2a7fbf5eceff4507690ba13c38817f4ecfa6cbc376ad8829ee121797a866ac
SnakeKeylogger
+ 59 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/230404-ww1v1sba7y/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6241220793:AAFx6XFOw5z4Op7twC8hAqYib_mTz67Z4Ak/sendMessage?chat_id=2054148913
Unpacked files
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
SH256 hash:
8fd9fe29be30f381199070f2c09d8213c0ac8be98836086052bb83fe53d7f6c3
MD5 hash:
2306789692c2e5e8ea14fe50fcb67f8a
SHA1 hash:
c8b5ebd3841889ece6b1fb8ee62d6b3aaf752912
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
Parent samples :
e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a
9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020
578873c16060e04fcfe43f9c9c04d2779a09a7566b3b4e97c1b18d87ac381057
04aa55e1600b801ddda368268eaf6f2ab9858f402b526468d727a943eadfb122
ce3c9c47d811745d5534bf268331382438b274a112d2327396cdc8623e82f98b
c7b06e2840e703c98fbe1fbfd9f33f5478e58840112d85c1e94c27a34474c95f
149c80ebeeead2dff7b45f8a627d5396b995f6afc82f18487d7c6eb4bf071205
SH256 hash:
7cc79dc9ed152e9cab77b0d0b9f6a3a40c3807d56a4a97ed8645bd42cf8f4496
MD5 hash:
16a91bcb2af324de5919a7adb677293b
SHA1 hash:
b011e58a4d59edb282c27d263dd545468284520e
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
SH256 hash:
04775ad5144d40d4e67b3f79904757b610976edea727bab558e08dbe8662216d
MD5 hash:
aeea42b461ce673db5c198ab74e7d694
SHA1 hash:
a2bb73149503d60c90b6c110b5e9ebf75e4e971e
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
Parent samples :
9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020
578873c16060e04fcfe43f9c9c04d2779a09a7566b3b4e97c1b18d87ac381057
04aa55e1600b801ddda368268eaf6f2ab9858f402b526468d727a943eadfb122
ce3c9c47d811745d5534bf268331382438b274a112d2327396cdc8623e82f98b
c7b06e2840e703c98fbe1fbfd9f33f5478e58840112d85c1e94c27a34474c95f
149c80ebeeead2dff7b45f8a627d5396b995f6afc82f18487d7c6eb4bf071205
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
SH256 hash:
58a2f74221a63a530896bb082168717d498bd6c2b5d6691b836c63cd172b89b6
MD5 hash:
8daad07d12ce95dbdee95cac069bfcf3
SHA1 hash:
4b1eb8ef02f89add6af082b19d610c7f7a7445e4
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
SH256 hash:
a06d486fe542903c94502597d35b1672d113c00b38cf6542701ca995dc2d47a8
MD5 hash:
bbd742c483c584d4e666ffd60435144e
SHA1 hash:
3bf8b7c289a313cecb4933d5cdaf58cfb2980b98
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
SH256 hash:
9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020
MD5 hash:
8aeb2829342f8bb9acb171472da1d64e
SHA1 hash:
b04d798d1375c242273fd6a1d8553b9312663668
Link:
https://www.unpac.me/results/cc612ce0-3d04-40c3-91ee-323868b05c27/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9d0618a3a602/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/380114/

Comments