MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847
SHA3-384 hash: 5521f7d949bd0c940920d0755dee29ff232d50d2b3bd203e3b776365189613593b02a4873f31af23761a4b85485c2e8e
SHA1 hash: 249c4536c9a44c10e9d526d0783b3cc6470b055a
MD5 hash: 18a5baa82c39ebb79a944f254fcf44b8
humanhash: pasta-illinois-potato-kansas
File name:FOTOĞRAF.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:914'432 bytes
First seen:2023-07-31 08:58:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:S+uZIEYmJ+37pZaIg+PkhDUU4Xj3/crlZGLE5nlpo8PBFbGo6N+cugyLyu:S+uKEYmQ37pZaIgVKDcZ1Y8JFU+cuTf
Threatray 5'393 similar samples on MalwareBazaar
TLSH T175155ED1F150CC9AED6B0AF17D2BA43024D3BE9D54A4810D5A99BB1B76B3342209FE1F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
307
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FOTOĞRAF.exe
Verdict:
No threats detected
Analysis date:
2023-07-31 09:00:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ba8845b2-5732-4aea-bbb0-7bc2a0aa91c8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/439383/
Detection(s):
SecuriteInfo.com.Variant.Ransom.Loki.24223.17908.7801.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching the default Windows debugger (dwwin.exe)
Gathering data
Verdict:
Malicious
Labled as:
Ransom.Loki.Generic
Link:
https://www.hybrid-analysis.com/sample/a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/28827674-e5bd-43bf-8248-ad6c12d8440b
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1283059
Signature
.NET source code contains potential unpacker
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-07-31 08:59:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
51
AV detection:
24 of 37 (64.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=urgsmlwxzaefwivncvstxuvh2pwmszwd47cueuw6kzym4zacpbdq._file
Verdict:
malicious
Similar samples:
0dfed6a80612475d64b34d2c0264f41ee06da61747fd3086786bcbc61212daf3
SnakeKeylogger
2cb7c9dc87cd618a4a307a8f7a054fc0acbb375e0dc2b3d041e5f5b9f138b601
SnakeKeylogger
3105a7886bb62b4a95672ed5a801e8063dfba87139195dfc5a7cfe32f3b4edf2
SnakeKeylogger
4d87691cc9ee123c1601b86054119c8a202d3f77b51b78306547d900b6a6b7c8
SnakeKeylogger
5d6c03383955c4784c08bcc14b863537f7fb451fd94a1fe7706b84576fb3819b
SnakeKeylogger
71a0f6429f7199e64b3c6d852696a9a8721e6f95598e279f276cfdf22db4e5b5
SnakeKeylogger
b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d
SnakeKeylogger
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SnakeKeylogger
+ 5'383 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230731-kxqwnadf82/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
7c743d979549f931d7101d1a14c14841ff47c848a3f30e31882d0d958bf5f941
MD5 hash:
508ba12479b3d78edb93f63b40ab3b7f
SHA1 hash:
d72b842c46546e4e494c9338b530e305dae1d5d2
Link:
https://www.unpac.me/results/9e939b40-9b27-4c5c-b5c9-b88826bdec83/
SH256 hash:
6cf753f40707113e2cf6480ac327d6187b439aaee539138c4faa10fb90d042ed
MD5 hash:
4f39797f58b1f8f82f852753ba64c86d
SHA1 hash:
8157432fa57845220b15100ca7132b58a221d56e
Link:
https://www.unpac.me/results/9e939b40-9b27-4c5c-b5c9-b88826bdec83/
SH256 hash:
730c38723cc85cedbe73e77a30c6dacff6c987749f0914efc68f1d279dbb34b6
MD5 hash:
730c08676840210e7278d26467c5e890
SHA1 hash:
6d94b2de4f1ed079b5a1bbbb9607721ec226fb1e
Link:
https://www.unpac.me/results/9e939b40-9b27-4c5c-b5c9-b88826bdec83/
SH256 hash:
434f37199f72097b15405d6214e00f2843e87f1befec097079f1471764910268
MD5 hash:
5aa57c2de7e265366591781e26032cda
SHA1 hash:
13d7676b5bccd72742a889357db4274b922c55e6
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/9e939b40-9b27-4c5c-b5c9-b88826bdec83/
Parent samples :
71a0f6429f7199e64b3c6d852696a9a8721e6f95598e279f276cfdf22db4e5b5
b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150
4d87691cc9ee123c1601b86054119c8a202d3f77b51b78306547d900b6a6b7c8
393242de003f1c79e502bfe5b8b073f2ce1f423d5871a2261bdeffd823f8c266
a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847
SH256 hash:
a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847
MD5 hash:
18a5baa82c39ebb79a944f254fcf44b8
SHA1 hash:
249c4536c9a44c10e9d526d0783b3cc6470b055a
Link:
https://www.unpac.me/results/9e939b40-9b27-4c5c-b5c9-b88826bdec83/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a44d262ed7c8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/439383/

Comments