MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a93b70eb6d8b21e04163be6ebc444ff76a557040e8d97021ec04a5a002cd5c8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a93b70eb6d8b21e04163be6ebc444ff76a557040e8d97021ec04a5a002cd5c8a
SHA3-384 hash: 8737332944c672ee6831472200591fa64b52771ddce1031927caa34066ff162c004fc13761bff7e16382870aa13a2852
SHA1 hash: bfaefa468f0091cee44e53b1d20b5d3af0d25ab0
MD5 hash: 03dbf0ff9f2eb35f107cc02c36087a4a
humanhash: cup-potato-kansas-white
File name:DHL_invoices last shipment.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'005'056 bytes
First seen:2022-12-12 08:30:10 UTC
Last seen:2022-12-12 23:17:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:LYKuB2iNGC6y0e96GzwutbR6RLlNberjScO:41UC6y0elzzyvRuSF
Threatray 5'354 similar samples on MalwareBazaar
TLSH T13B25116FCFAB5123C575D1B78FF398676251BC163200AD686A9937081229D1EB8C3D3E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon acac0001000001a2 (15 x AgentTesla, 4 x SnakeKeylogger, 1 x Formbook)
Reporter abuse_ch
Tags:DHL exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL_invoices last shipment.exe
Verdict:
Malicious activity
Analysis date:
2022-12-12 10:27:11 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/1ffc2ccf-0cd2-4a66-8ad5-79a3d04c15f7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/345346/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6396e6c6f6e448d42df82a02/reports/61a1ef79-8ed0-400b-b8f8-a49fb4128e05/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b5226863-9fa6-4cfa-a126-17d68bb0845e
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1132471
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a93b70eb6d8b21e04163be6ebc444ff76a557040e8d97021ec04a5a002cd5c8a/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2022-12-12 08:31:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ve5xb23nrmq6aqldxzxlyrcp65vfk4ca5dmxaipmass2aawnlsfa._file
Verdict:
malicious
Similar samples:
1d1f8cd03f7d4657ff1e304e5bfa47a7affa34e3d7b093aae1d31f489550dd98
SnakeKeylogger
50da774fda04ec1034035862f80ea8933397e34b66ac58c239c369836e341be0
SnakeKeylogger
6069a9d373b71c1217c3415634dfadeed9cfa0baa4949d640fe515d92b5a8a27
SnakeKeylogger
658cb26b4f26e4ecf21c85c6138ceb52c614ca4092a69c365d324ff0b4b0d7c0
SnakeKeylogger
7319a8d431cd1a967b517cd21b9aa7c0f86b1716e7e2492dd2e831a65406c460
SnakeKeylogger
7c0ccddd1e886d81fbcd8e4c62e6d61ce7e78258825a1f2ef1bc7edca4179cd5
SnakeKeylogger
b25bf746f3e6166cea9a957e783de9fe41c91c67259b8a16dd1af86f187d610b
SnakeKeylogger
f293c00ae925b1e3160d4104f35de999a31728aa5b636dd945d2ceb1d5045c01
SnakeKeylogger
f5b5997f3b718acf9ad712558e910e0d0c4777d8882207c05510f6c42cb3013d
SnakeKeylogger
+ 5'344 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection evasion keylogger stealer
Link:
https://tria.ge/reports/221212-kepwmsdf3v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5484820495:AAGEjy8dT72vJZImmHLmeh3onMuG9LLRD5A/sendMessage?chat_id=5101327412
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8ea28138-58e5-4442-b307-b92171058f39
Unpacked files
SH256 hash:
e43d8d7fc9592084354784b05443a1d32ef2ecf822c7317886fdfe09bec33260
MD5 hash:
a1c59d57bb339db4f37c6bd74572eb1a
SHA1 hash:
b6f583f546b7df26c0929a8b4c4806314d5639ab
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/98ddbfc6-e5ce-4097-99cf-375675396114/
Parent samples :
38950a141d412584636b4e97742db5aebe480e9edc467ef5b532e0216879f44a
7241d8e398ed2bc2973ad2f9a905d5bfdce3b02fcaa3b60c0a4ef1fd194f51ef
f913943b5082aed8ba09b537e3d9328a9f6894dc3ab93a1defb3f43a69078eb3
7776ae6f6274f264a686785c2970782847826bdd9c6a3cbcabab0573f449c174
962b66d01dbbe1dd3cd85dcbe030c318d2f685fe5a965133279f5afb3b6adb94
b4fde3291600549dc094b96ea4afd8520afd1cc16bf7196faf2e11c6281b9b8a
514962de0cfcafea5c6a6ff3c7162c8a9ac2a7362f44812c9f74cf92092c0af3
b44211d828b159e40ceac13bcc9f4090aabb146c02d06a0836cba88bc465c88e
2eaf90482aaf8c1c7ee6ac3533c0c8831e8848d280e0e243829bf24c1393dd63
0ce4d6e8ba3ba2d916a91b04d863bc33727ab419f3f8013b3cb610bd49a5b104
6555c5be3926aa465cffc7d5ac89f0bc94ed54155525281141ddc3ec9c6bf33f
6deb2bb7b87e2cb22966a1cd3c54a04948a36474c017c1a6cc622df6b928211c
95f955291eebbed5c72e6956296cba4ac8e169ecab4881a93c9938834a56549a
f2fbf3aacd32bdcd8dc22abc45d879eb863dff437484913e1242bb6f277f1b53
790027b5d9e45f536c779d6527483930da9e3b5891f5a5767363d496a1d528cb
64c749751bffaa96432c647beb4f8ed81a7c811bc6dc0a6763f44455a7c4d5f3
9f5da29a4b91ad8996aa600ac824a5667400dde0076bdff5c5b27652f0df000b
eec2c52990c31a2482d0acf15788db765b705baf2bb149d5cbe013d8c055c51d
b8216cdc194ab1f82820fc2a29ca63af3a1f3e6b80102ab658c1ee33b7dd68da
38b404c76de7b2c70cc770583b5917deefe31be51acf2caafc39b3fd884a9ede
8e603a99770c15419c36fd082b789d2285e7ddfd77da47cf9f9be899c350d913
a93b70eb6d8b21e04163be6ebc444ff76a557040e8d97021ec04a5a002cd5c8a
06cf43a592776ad9e34f1efc2cdbf859599710b25f395d871b5a5e13d88b30d8
24704e7cf611284dbe00a83b66ade87369dfb967016da89e78add0f004e5bcb9
284a1c6b11e8c221f4ab44da36c5b12eb6941d575003de79e918fd1a47a0cd24
2200860726cd8b2d878f4194b29418ca4cf2b2ca056ba21d5fd34ce3362b9c7e
9ae533dd395882eef0df206750f1fff09e5eab9a4397515632d15fd248f72ca4
34b91aa79335759905f9405680460480b9d3a759c32e972192c0e6c41f3d7c36
2b0d30ca1ad2a366fa11c3808abe98aeada07d82b17361cba2e01cf21c9992eb
8afbcd46ec9038c7e7479677a5b440764e3e61a9c99fa8b22c816727a21b17a6
682d2d533c6ebad2e51c0261add6a4b633e0a0b3149cb3396b20271d6b87470b
a9498e6102ca86f0b3500796103e30d7e7f4b955441711450f3228ea06e2b8ac
SH256 hash:
a327516357b9fa1a75753b3fbd0030e13f374be7cefcdf983d0b731f278b0c59
MD5 hash:
404efdeb9931733904da07f96fabeb72
SHA1 hash:
7ce363cd612f1d9a90b33ec196c4d0a49cdaee02
Link:
https://www.unpac.me/results/98ddbfc6-e5ce-4097-99cf-375675396114/
SH256 hash:
faf7f93f2ebbe88022b6cd1e83d62cdfbfbb0858cab67c9ebc97426d26e381ba
MD5 hash:
95158d0d35140fd641340b5955a29c2f
SHA1 hash:
0ac9a96444351f28729b6bf9bc9f82279606f93a
Link:
https://www.unpac.me/results/98ddbfc6-e5ce-4097-99cf-375675396114/
SH256 hash:
a93b70eb6d8b21e04163be6ebc444ff76a557040e8d97021ec04a5a002cd5c8a
MD5 hash:
03dbf0ff9f2eb35f107cc02c36087a4a
SHA1 hash:
bfaefa468f0091cee44e53b1d20b5d3af0d25ab0
Link:
https://www.unpac.me/results/98ddbfc6-e5ce-4097-99cf-375675396114/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a93b70eb6d8b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a93b70eb6d8b21e04163be6ebc444ff76a557040e8d97021ec04a5a002cd5c8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/345346/

Comments