MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a0d2c441e7ddea80e1a86a202a9a75b8c97fe8fbcbd7899f1bec8a66df7c473c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 14
| SHA256 hash: | a0d2c441e7ddea80e1a86a202a9a75b8c97fe8fbcbd7899f1bec8a66df7c473c |
|---|---|
| SHA3-384 hash: | e4431e6d614fee221bbca88d08289c3feb3b2bb1b654d98d27db08a52d423750217096a04d85986f75c86193e2aa4539 |
| SHA1 hash: | 76a7110247f99105cd3cf141f87657ee7e623e07 |
| MD5 hash: | 0f91a040ebe6ea2f68b3597ad3389169 |
| humanhash: | oregon-low-pip-seventeen |
| File name: | Confirmación de pago de factura.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 654'848 bytes |
| First seen: | 2023-04-25 15:30:39 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:CLm+vY07/P9M/y9Z91Q4fwAel3qq9n8o2iBXGUH+/a:0m0/fZU+whl/ZAi1G0+/a |
| Threatray | 4'949 similar samples on MalwareBazaar |
| TLSH | T137D4593C29BD623BC179DAB98FE5D827F444D86B3121AE35A4D747624706E2231C723E |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
257
Origin country :
NLVendor Threat Intelligence
Detection:
Snake
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
DNS request
Sending an HTTP GET request
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
formbook packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger, StormKitty
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Contains functionality to register a low level keyboard hook
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-04-25 15:31:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
16 of 24 (66.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 4'939 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Score:
10/10
Tags:
family:snakekeylogger family:stormkitty collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
StormKitty
StormKitty payload
Unpacked files
SH256 hash:
02975fb2650b8cec6e7b9d6295ee41de946071559e8cbbb6493c14d3dde9eb22
MD5 hash:
13b07311e29bf45a4a771a7651c3fa7b
SHA1 hash:
e90f39fad469272a971b02958c284550246f7d23
Detections:
snake_keylogger
SH256 hash:
829795ab5c8a80609cf3e7ce764ebf7fe33fd196b40d799670d23a3fcf85c0c1
MD5 hash:
219d339c63fcefe905193a88f71f2f87
SHA1 hash:
e2ca0aa9c7b1e2d7a52d7126333d34af5bacfb11
SH256 hash:
8048be5e15954834e2fe058e5671616844c8c5d8b4f3a00f383aef1ab11c8551
MD5 hash:
07dd4f85110c3bf250816702d1d33e30
SHA1 hash:
359c62c65a57b5ace1895984bdf3c64c8bf31953
SH256 hash:
e5518e76f14e87bcc58a705c6f8f3a686cbffefc0e55985d17a067adfddf3688
MD5 hash:
920a2854e9c183ad2ef7d5543c296d38
SHA1 hash:
2c20da753bdf6f1a46261e2c132dd42f75c94229
SH256 hash:
236c372d3998c961b84abd8b028463f99ed2d408dc8b05b20c5b65c9d66654a7
MD5 hash:
a2408f7432726664cebd87c4b0198970
SHA1 hash:
2723de139edbdede4b84688f0fffc1fda96cb4a6
SH256 hash:
a0d2c441e7ddea80e1a86a202a9a75b8c97fe8fbcbd7899f1bec8a66df7c473c
MD5 hash:
0f91a040ebe6ea2f68b3597ad3389169
SHA1 hash:
76a7110247f99105cd3cf141f87657ee7e623e07
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.