MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab3bd41484af4af797f93d64c2c420accfdb426c635bdcbad90bfef989b2f4db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab3bd41484af4af797f93d64c2c420accfdb426c635bdcbad90bfef989b2f4db
SHA3-384 hash: 863eba4aec45591ed9895422c00f716eb83be5332929b1812ef19db1a4debe2d1cbef5aaf3ab6c1eaae23200f0ab5594
SHA1 hash: 85202a3dbc9fb80e7b546dc41c06bf4b003ec6c0
MD5 hash: 39bfde43f309493524d476ba8b760f0a
humanhash: single-rugby-indigo-september
File name:0900000000000000009.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:464'863 bytes
First seen:2021-07-12 12:57:46 UTC
Last seen:2021-07-12 13:56:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 6144:TqjIZauT1xmPENH8PaCHDbZZfvdHKMIBRBuuFXfMf5E/eRGD8:Owa61MmcPaCHDbZZfvtK5BuMMf5jy8
Threatray 288 similar samples on MalwareBazaar
TLSH T170A46E6291DAA412EABDF2F21210D96D34E6F8CE3D75786121847E376C5BE804738EF1
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0900000000000000009.exe
Verdict:
Malicious activity
Analysis date:
2021-07-12 12:59:58 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/39f16e0f-bd80-40f5-9bdc-4f462bf17728

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171096/
Detection(s):
SecuriteInfo.com.Gen.Variant.Jaik.46772.19958.25676.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4998bffb-82fc-4a63-bd1e-4fea66216c2e
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814854
Signature
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Contains functionality to capture screen (.Net source)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 447275 Sample: 0900000000000000009.exe Startdate: 12/07/2021 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for dropped file 2->44 46 5 other signatures 2->46 6 bbpd.exe 15 2->6         started        10 0900000000000000009.exe 1 19 2->10         started        12 bbpd.exe 15 2->12         started        process3 file4 22 C:\Users\user\AppData\Local\...\shweyzfm.dll, PE32 6->22 dropped 48 Writes to foreign memory regions 6->48 50 Maps a DLL or memory area into another process 6->50 14 MSBuild.exe 4 6->14         started        24 C:\Users\user\AppData\Roaming\...\bbpd.exe, PE32 10->24 dropped 18 MSBuild.exe 15 4 10->18         started        52 Machine Learning detection for dropped file 12->52 20 MSBuild.exe 4 12->20         started        signatures5 process6 dnsIp7 26 checkip.dyndns.org 14->26 28 162.88.193.70, 49735, 49736, 80 DYNDNSUS United States 14->28 54 Tries to steal Mail credentials (via file access) 14->54 56 Tries to harvest and steal ftp login credentials 14->56 58 Tries to harvest and steal browser information (history, passwords, etc) 14->58 30 checkip.dyndns.org 18->30 32 checkip.dyndns.com 216.146.43.71, 49718, 49719, 80 DYNDNSUS United States 18->32 34 freegeoip.app 104.21.19.200, 443, 49720, 49731 CLOUDFLARENETUS United States 18->34 60 May check the online IP address of the machine 18->60 36 checkip.dyndns.org 20->36 38 131.186.161.70, 49729, 49730, 80 DYNDNSUS United States 20->38 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab3bd41484af4af797f93d64c2c420accfdb426c635bdcbad90bfef989b2f4db/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-12 12:58:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vm55ifeev5fppf7zhvsmfrbavth5wqtmmnn5zowzbp7ptcns6tnq._file
Verdict:
malicious
Similar samples:
022e918d8b07b6bda3fc703e212db5d145fa5814f33ea2fa8a350e2be405a348
SnakeKeylogger
12fd71647d0ddc3a5619975288f310047162f1258765d337efaee411c9f7e7f4
SnakeKeylogger
1c7a790071604c278c73b380f6226788105af99809949e387d80b1e7fd395e27
SnakeKeylogger
42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81
SnakeKeylogger
549b1c385da022b7a956a88993359279d053227adf005eacc80e92d340921958
SnakeKeylogger
7010546f9366fc5ff5ec208985159b5aeddc897e3dd0f811a6835c5debd96d55
SnakeKeylogger
e0da065f5de30c5ba0f494a5e042fadef310039fef35896a61756d49c6e21611
SnakeKeylogger
f65f899fc6cc494d6c59311f4a0519fa6ba0c9859c8ce13a5adc30aa9fd1817b
SnakeKeylogger
+ 278 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210712-8qlv5pvepa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Unpacked files
SH256 hash:
049a3787d59652f29e40d7882abac625fded66dd5a20f61060e6910515a019f7
MD5 hash:
dbb8c873ebb0a95e9f7c83b5d68d6579
SHA1 hash:
ffd776a2b0cd82835f437a41602cd403823140db
Link:
https://www.unpac.me/results/dcf582c1-5810-4033-81cb-f69e928d2d3b/
Parent samples :
932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14
6379623552f5d0965d8cfe83f3725942907a9b26766e3e6cb5e27258b1e120d9
SH256 hash:
f4fc81c446e9276b54944f689322f0c6f2a1c82b826f934485ad0a051574c38b
MD5 hash:
a1d0cfb35be8f4111f6f58d4d8a44640
SHA1 hash:
18e32f8941d032bb98b4e3f9f531a707e2f467e4
Link:
https://www.unpac.me/results/dcf582c1-5810-4033-81cb-f69e928d2d3b/
SH256 hash:
d0b8aea7aeaca68a9c1ecb94bf5eca7c983a38152f8b10685dd0d85d3d98275e
MD5 hash:
aae693a4bff4ed86222d663cbec4a6fd
SHA1 hash:
77c80afa24e40ccef9a758758da56553a5ca2335
Link:
https://www.unpac.me/results/dcf582c1-5810-4033-81cb-f69e928d2d3b/
SH256 hash:
ab3bd41484af4af797f93d64c2c420accfdb426c635bdcbad90bfef989b2f4db
MD5 hash:
39bfde43f309493524d476ba8b760f0a
SHA1 hash:
85202a3dbc9fb80e7b546dc41c06bf4b003ec6c0
Link:
https://www.unpac.me/results/dcf582c1-5810-4033-81cb-f69e928d2d3b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ab3bd41484af4af797f93d64c2c420accfdb426c635bdcbad90bfef989b2f4db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICOIUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe ab3bd41484af4af797f93d64c2c420accfdb426c635bdcbad90bfef989b2f4db

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/171096/

Comments