MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 aade9e4c1ff0e22d68b3c1c2a051c7ebc2bf83eb18bfe4c17394ba96af76bda4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 13
| SHA256 hash: | aade9e4c1ff0e22d68b3c1c2a051c7ebc2bf83eb18bfe4c17394ba96af76bda4 |
|---|---|
| SHA3-384 hash: | b4c6d631fe3d482e203e51a0a75b10adce5bf3638a127841452a6503c0138c01fff095ea88c9698e93819ae64df2f4c5 |
| SHA1 hash: | 54fa432a1407444e99e204c788dc0bf7a591bd90 |
| MD5 hash: | edb830b78b9bbf1123472b818314d339 |
| humanhash: | massachusetts-angel-nebraska-asparagus |
| File name: | edb830b78b9bbf1123472b818314d339.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 707'584 bytes |
| First seen: | 2022-06-05 08:04:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger) |
| ssdeep | 12288:PEqNzOjtcAacH81V+AwKTrJccu/0WUS33TETvrdIyyoQP8+83X6oJ6Hp:6t5H8yIfJe9UKI6WQ23KogHp |
| Threatray | 5'481 similar samples on MalwareBazaar |
| TLSH | T1FEE401D26D69BB12CC7A47F9317294BC27B32D6F3610E78E8D93F8CA1174B4056129A3 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Reporter |  abuse_ch |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://www.mediafire.com/file/7teye81fip3n540/SKM-GC039287110561003000032768_pdf.tgz/file
Verdict:
Malicious activity
Analysis date:
2022-06-03 09:27:37 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code references suspicious native API functions
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-06-02 21:56:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 26 (76.92%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 5'471 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5175347690:AAHm7jPZexId550_rwKxplhdjxg_CWLfF30/sendMessage?chat_id=5138265724
Unpacked files
SH256 hash:
9351baacfb03aaebb433bbf5da61c975a97005f8a64120798c93f7357e3f5f3a
MD5 hash:
265386e1302eb0cf1ba1d6c6a1acbd06
SHA1 hash:
93769a1320b0ff045692a8b7c28b10dc5910e3ba
SH256 hash:
879c29560b21be7d9b69ca27ca4756df86e080fa3e34cb191aad5cb1e5f05504
MD5 hash:
30b6a54a992eae921a2eb8c5ea130911
SHA1 hash:
1c83f0319bffe007077c6656418c9b7344d5affe
SH256 hash:
c0ae7c7d6216c80fe0696c1418355f1b353f121ebe300d6745828ca06a53002c
MD5 hash:
567e526f612e841ea313752c1d809fcc
SHA1 hash:
175884527b1039de3f83f00759bb1acd6534b051
SH256 hash:
d4cf3cb630a3555467457ca4ff018f5b50a0c84c4dee13b341299b82460209ad
MD5 hash:
e053f3cf8106ed5665f880b7e85b0941
SHA1 hash:
12b438ea895e83bde659e3b068ba8cf065a6ad38
SH256 hash:
aade9e4c1ff0e22d68b3c1c2a051c7ebc2bf83eb18bfe4c17394ba96af76bda4
MD5 hash:
edb830b78b9bbf1123472b818314d339
SHA1 hash:
54fa432a1407444e99e204c788dc0bf7a591bd90
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.