MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1ef7c34fac1d166d47f99112a77e8f00f229c78f3a248da9ef005387997001a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1ef7c34fac1d166d47f99112a77e8f00f229c78f3a248da9ef005387997001a
SHA3-384 hash: feabbe54fdc1f6b2453a90475ffd344e7d08ce7bac6786ae3c52b17efe137faa383a9690c2ff447099503d245c13c107
SHA1 hash: ea4073537a6c8c842f73cb415cd865f78e6d0817
MD5 hash: aea6adfba6a5a177f26cd2a1eb97f0e2
humanhash: mike-iowa-artist-oregon
File name:aea6adfba6a5a177f26cd2a1eb97f0e2.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'030'144 bytes
First seen:2021-08-28 18:17:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:fYhbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyy:2wFLDR43j0DEF8v5zUBrK
Threatray 858 similar samples on MalwareBazaar
TLSH T11225663DAD292533E7BA86F8C4864D4EE69454CB26334DDF42D2A7893007617B6FA31C
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
aea6adfba6a5a177f26cd2a1eb97f0e2.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-28 18:17:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/485ab569-8c51-41aa-8dd0-2966cb12cb37

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/183109/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.DZG.genEldorado.19979.20991.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/554ede8d-61b5-4041-b168-36d838a6fd04
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/840820
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 473251 Sample: mkdPbuSwuu.exe Startdate: 28/08/2021 Architecture: WINDOWS Score: 100 22 Found malware configuration 2->22 24 Malicious sample detected (through community Yara rule) 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 7 other signatures 2->28 7 mkdPbuSwuu.exe 3 2->7         started        process3 file4 18 C:\Users\user\AppData\...\mkdPbuSwuu.exe.log, ASCII 7->18 dropped 30 Injects a PE file into a foreign processes 7->30 11 mkdPbuSwuu.exe 2 7->11         started        13 mkdPbuSwuu.exe 7->13         started        signatures5 process6 process7 15 dw20.exe 22 6 11->15         started        file8 20 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 15->20 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1ef7c34fac1d166d47f99112a77e8f00f229c78f3a248da9ef005387997001a/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-08-28 18:18:06 UTC
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uhxxynh2yhiwnvd7teisu57i6ahsfhdy6orerwu66actq6mxaana._file
Verdict:
malicious
Similar samples:
0de82472365b9fa6ebcd11bbcebdd24f64e7e51ce69379a751711e94b04b278f
SnakeKeylogger
333b05f9732e8516f6c557115b9f88b53b13f9b0d473d58ad33f0bdf4b937fe9
SnakeKeylogger
3b1c4fb3ad9793fe6347978b9a5b399d0ef84ad25c11ea191d217cd173b6a05d
SnakeKeylogger
456a207ab8eb1c3504c9e187d3a9bfab0509212acb329f1c820c1aa4b977e584
SnakeKeylogger
71d43dd5594e4d74bc9c4e79f13089f1f8938831f8155c49025d634cb9ab2423
SnakeKeylogger
7eb24308d8b3c88bd77726ea6b1fa55fda8cc46f6c4ab18f91c78796cb92921a
SnakeKeylogger
f459d614edff77838be813239333862330a5d5c2b66fceb69d053c0bfa24389c
SnakeKeylogger
f99002091475b0c5f423e2d9efe182de66019616c5fda6205efc3d9bd2f5ff45
SnakeKeylogger
fdcb93d14d249d6970c9f7374eb95190af62db72b5555c48d23a3af20902b682
SnakeKeylogger
+ 848 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210828-aa19nql6je/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Snake Keylogger
Malware Config
C2 Extraction:
https://api.telegram.org/bot1880141509:AAHjseWsCVnzygKB72YGbdj6S0DpdeKfGSs/sendMessage?chat_id=565072597
Unpacked files
SH256 hash:
588e37747084f1fd6be907c7dfa24ae3dfdcd3fb9327c6bdc9a356d594156656
MD5 hash:
3e01eb84572c60b0862a92f0e23e3b38
SHA1 hash:
b80267db6c99ff2db0de261899965125614a9f77
Link:
https://www.unpac.me/results/01b34c20-3ef7-4162-8d35-2c3881ab3bf4/
SH256 hash:
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345
MD5 hash:
f62ab5d3528d5a3b9e270ea1f9347868
SHA1 hash:
6a74e87711c615adbd9145f829a33f55b7e42dd6
Link:
https://www.unpac.me/results/01b34c20-3ef7-4162-8d35-2c3881ab3bf4/
SH256 hash:
7eb4302c92c1de3d5b2cd6467abe82e996c14aa6795f928434206b9ee62cbad0
MD5 hash:
dec06cc9d18f85918d79945e80abe374
SHA1 hash:
440e76a86775ad14f02bdbea79cef813c9ecd652
Link:
https://www.unpac.me/results/01b34c20-3ef7-4162-8d35-2c3881ab3bf4/
SH256 hash:
a1ef7c34fac1d166d47f99112a77e8f00f229c78f3a248da9ef005387997001a
MD5 hash:
aea6adfba6a5a177f26cd2a1eb97f0e2
SHA1 hash:
ea4073537a6c8c842f73cb415cd865f78e6d0817
Link:
https://www.unpac.me/results/01b34c20-3ef7-4162-8d35-2c3881ab3bf4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/a1ef7c34fac1d166d47f99112a77e8f00f229c78f3a248da9ef005387997001a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe a1ef7c34fac1d166d47f99112a77e8f00f229c78f3a248da9ef005387997001a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1566394/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183109/

Comments