MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad3b71cf9d53af23de0805e4d2eb68955c250296b60ea44beac0b3cbb18b64a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad3b71cf9d53af23de0805e4d2eb68955c250296b60ea44beac0b3cbb18b64a5
SHA3-384 hash: a3555fc4fb3c2e6c840c5434e40ae97b443d9871357f1b8d9cbd2b2de7be951c8caf0f5f8124f6fe8da19ba6c631d1d0
SHA1 hash: c344e497680dc70f0e1b5050f18b595866f6d137
MD5 hash: 7b09a5668fab45085d45c2a40a29af55
humanhash: jig-whiskey-robert-oven
File name:090-0000000000900.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:632'320 bytes
First seen:2021-01-11 18:41:48 UTC
Last seen:2021-01-12 09:53:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:fbpV4CgJjgVtZ2zdkC0SHdOeI5/DM5Jj0R:fvmj7pO39DM5h0R
Threatray 1 similar samples on MalwareBazaar
TLSH 4CD4C006B20400E6E2D578B46AA1CCE7DB7EADDCA794C1476652B7166E3F23A430D43F
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: r.abouldahab@emis-int.com
Subject: ORDEN DE COMPRA-090990
Attachment: 090-0000000000900...pdf...z (contains "090-0000000000900.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
090-0000000000900.exe
Verdict:
Malicious activity
Analysis date:
2021-01-11 18:51:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/77ec5c7e-90c6-4e0f-a4c9-5843adb3b6d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/111338/
Detection(s):
SecuriteInfo.com.FileRepMalware.7327.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a file
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/578321
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Drops PE files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Powershell drops PE file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 338214 Sample: 090-0000000000900.exe Startdate: 11/01/2021 Architecture: WINDOWS Score: 100 46 Antivirus detection for dropped file 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 Yara detected Snake Keylogger 2->50 52 4 other signatures 2->52 7 090-0000000000900.exe 3 2->7         started        11 I$s#$lT3ssl.exe 3 2->11         started        process3 file4 28 C:\Users\user\...\090-0000000000900.exe.log, ASCII 7->28 dropped 54 Writes to foreign memory regions 7->54 56 Allocates memory in foreign processes 7->56 58 Injects a PE file into a foreign processes 7->58 13 powershell.exe 14 7->13         started        17 InstallUtil.exe 15 2 7->17         started        20 InstallUtil.exe 2 11->20         started        22 powershell.exe 18 11->22         started        signatures5 process6 dnsIp7 30 C:\Users\user\AppData\...\I$s#$lT3ssl.exe, PE32 13->30 dropped 32 C:\Users\...\I$s#$lT3ssl.exe:Zone.Identifier, ASCII 13->32 dropped 60 Drops PE files to the startup folder 13->60 62 Powershell drops PE file 13->62 24 conhost.exe 13->24         started        34 checkip.dyndns.org 17->34 36 checkip.dyndns.com 162.88.193.70, 49729, 49730, 80 DYNDNSUS United States 17->36 38 freegeoip.app 104.28.4.151, 443, 49734 CLOUDFLARENETUS United States 17->38 40 checkip.dyndns.org 20->40 42 131.186.113.70, 49746, 49747, 80 DYNDNSUS United States 20->42 44 2 other IPs or domains 20->44 64 Tries to steal Mail credentials (via file access) 20->64 66 Tries to harvest and steal ftp login credentials 20->66 68 Tries to harvest and steal browser information (history, passwords, etc) 20->68 26 conhost.exe 22->26         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad3b71cf9d53af23de0805e4d2eb68955c250296b60ea44beac0b3cbb18b64a5/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 18:42:05 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vu5xdt45koxshxqiaxsnf23isvockauwwyhkis7kycz4xmmlmssq._file
Verdict:
unknown
Similar samples:
b246071c05dec2f4838b27fd6c11548e90f7deaaeb658530864d10efdb129c37
SnakeKeylogger
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210111-zpg28yjwls/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Drops startup file
Unpacked files
SH256 hash:
f41cb1dff6e494b4b912a306cad67c2b0016e3328c157092c017043e44bf6b37
MD5 hash:
c6e13c37156a0d67911245fa7e06c837
SHA1 hash:
714151ceaf538a76c394c750d94189cc68ab650c
Link:
https://www.unpac.me/results/787040f1-45af-47ab-96d5-05cd4dfab2b6/
SH256 hash:
40d4d775760861b5b901cf280b4ca0d30d465045204c2f28df2a4a0e4d158712
MD5 hash:
01b0ce2eec178c4bec3b3e862b910aeb
SHA1 hash:
a13939b313e4138ef8f096fd2b9de6e2b09e450e
Link:
https://www.unpac.me/results/787040f1-45af-47ab-96d5-05cd4dfab2b6/
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/787040f1-45af-47ab-96d5-05cd4dfab2b6/
SH256 hash:
ad3b71cf9d53af23de0805e4d2eb68955c250296b60ea44beac0b3cbb18b64a5
MD5 hash:
7b09a5668fab45085d45c2a40a29af55
SHA1 hash:
c344e497680dc70f0e1b5050f18b595866f6d137
Link:
https://www.unpac.me/results/787040f1-45af-47ab-96d5-05cd4dfab2b6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad3b71cf9d53af23de0805e4d2eb68955c250296b60ea44beac0b3cbb18b64a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 1cfa92c4cadab5c6ba60b9a1107430f6eaaa630ca7a8b22e779c12cb3cce90ec

SnakeKeylogger

Executable exe ad3b71cf9d53af23de0805e4d2eb68955c250296b60ea44beac0b3cbb18b64a5

(this sample)

  
Dropped by
MD5 8232550dbc855e494f4012660415126e
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/111338/

Comments