MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33
SHA3-384 hash: 343248f5e2c7d511d683e6ca80276d6dab68d21413548194288d85ea535f5d1e3c48d6a3db9840d0c4a12d08d3c167b4
SHA1 hash: 6d3a1b2806fb16d6701d75cb5c1b35de3ad430ed
MD5 hash: a9564019da9ffbde844cbddf6dd9ac95
humanhash: tennessee-california-aspen-ink
File name:854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:626'176 bytes
First seen:2023-07-11 12:47:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:nN1y+uEVL/OuOgiXchyPGcXHrnH7bwJp/OAUBGlVl4lOSNJHPR:D2uZccrmHrH7bwXOAUgljS
Threatray 5'348 similar samples on MalwareBazaar
TLSH T11ED4029862B88F27D43FCBF91051203493F466DAB912E3874DC734EB2D53F9A4A29653
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 4428d4ccd4d03028 (10 x AgentTesla, 3 x SnakeKeylogger, 2 x Formbook)
Reporter TeamDreier
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-07-11 12:53:32 UTC
Tags:
snake evasion keylogger trojan
Link:
https://app.any.run/tasks/17702206-07d7-4c8e-939a-f5e1c0532788

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/415597/
Detection(s):
SecuriteInfo.com.Trojan.Loader.1598.14902.26886.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Forced shutdown of a browser
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64ad4f83a15fc7eb4fd0c1ee/reports/a7b7a9eb-f85b-499f-9bf8-734c215bfbcb/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bbf19e94-aca3-4aa6-a151-6c7f0799e679
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1270877
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-11 11:15:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vv5nfzunc7bga77vgusbuduuawq6aij3bdhuxw66hpvyap25xizq._file
Verdict:
malicious
Similar samples:
0dfed6a80612475d64b34d2c0264f41ee06da61747fd3086786bcbc61212daf3
SnakeKeylogger
2cb7c9dc87cd618a4a307a8f7a054fc0acbb375e0dc2b3d041e5f5b9f138b601
SnakeKeylogger
3105a7886bb62b4a95672ed5a801e8063dfba87139195dfc5a7cfe32f3b4edf2
SnakeKeylogger
3dedd91d5d734fdea8fa04714e99b1fdcac4c06626ad2e10aa825e71fc18c3c3
SnakeKeylogger
4290a78ffba42133cf4952389a5945a4961961056425284fe2142784bf4af9a7
SnakeKeylogger
5d6c03383955c4784c08bcc14b863537f7fb451fd94a1fe7706b84576fb3819b
SnakeKeylogger
6e6f28265a65efc29248f1bc10513f4c2320edba637d87f8341df71fa113dcd3
SnakeKeylogger
90b37ea81aba9787a883970ff011dbbf5da729fc915bf3dc104704111fbc2848
SnakeKeylogger
e5fe74a699fdee524980b0ccdfe82a6a98abd5c011ba909822455b831720b686
SnakeKeylogger
+ 5'338 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230711-p1rpksab4t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6398750980:AAHdEX-sl3vmCKHFTkCkoZt9sCUIRpKV8ZA/sendMessage?chat_id=6008123474
Unpacked files
SH256 hash:
90bdc695696f640344a850ed7cb975b0b97838b85a1bcabed657b7765b388f15
MD5 hash:
91d38b3c68e4dffaab53eda32779b63f
SHA1 hash:
e8249faacee10826f0807bfea8a31285da8b6990
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
90bdc695696f640344a850ed7cb975b0b97838b85a1bcabed657b7765b388f15
MD5 hash:
91d38b3c68e4dffaab53eda32779b63f
SHA1 hash:
e8249faacee10826f0807bfea8a31285da8b6990
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
a103a970a7cd8be0fbe123a6a7abdfe4779a0786fda636fc96673492c4691e7e
MD5 hash:
2f0ec664f81bd7e8e33fd00c238320cc
SHA1 hash:
b0472a4b7f0bc69100a43a24214cf796af2496bb
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
a103a970a7cd8be0fbe123a6a7abdfe4779a0786fda636fc96673492c4691e7e
MD5 hash:
2f0ec664f81bd7e8e33fd00c238320cc
SHA1 hash:
b0472a4b7f0bc69100a43a24214cf796af2496bb
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
MD5 hash:
a4f37839caefd1a14b4b1d20a9691195
SHA1 hash:
8442a5e7428cb3ba89d11beb8c427969da6610c9
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
Parent samples :
ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SH256 hash:
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
MD5 hash:
a4f37839caefd1a14b4b1d20a9691195
SHA1 hash:
8442a5e7428cb3ba89d11beb8c427969da6610c9
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
Parent samples :
ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
90bdc695696f640344a850ed7cb975b0b97838b85a1bcabed657b7765b388f15
MD5 hash:
91d38b3c68e4dffaab53eda32779b63f
SHA1 hash:
e8249faacee10826f0807bfea8a31285da8b6990
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
90bdc695696f640344a850ed7cb975b0b97838b85a1bcabed657b7765b388f15
MD5 hash:
91d38b3c68e4dffaab53eda32779b63f
SHA1 hash:
e8249faacee10826f0807bfea8a31285da8b6990
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
a103a970a7cd8be0fbe123a6a7abdfe4779a0786fda636fc96673492c4691e7e
MD5 hash:
2f0ec664f81bd7e8e33fd00c238320cc
SHA1 hash:
b0472a4b7f0bc69100a43a24214cf796af2496bb
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
a103a970a7cd8be0fbe123a6a7abdfe4779a0786fda636fc96673492c4691e7e
MD5 hash:
2f0ec664f81bd7e8e33fd00c238320cc
SHA1 hash:
b0472a4b7f0bc69100a43a24214cf796af2496bb
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
MD5 hash:
a4f37839caefd1a14b4b1d20a9691195
SHA1 hash:
8442a5e7428cb3ba89d11beb8c427969da6610c9
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
Parent samples :
ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SH256 hash:
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
MD5 hash:
a4f37839caefd1a14b4b1d20a9691195
SHA1 hash:
8442a5e7428cb3ba89d11beb8c427969da6610c9
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
Parent samples :
ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
SH256 hash:
ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33
MD5 hash:
a9564019da9ffbde844cbddf6dd9ac95
SHA1 hash:
6d3a1b2806fb16d6701d75cb5c1b35de3ad430ed
Link:
https://www.unpac.me/results/3fa42296-82c4-440a-9242-eedfbc86c090/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ad7ad2e68d17/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe ad7ad2e68d17c2607ff535241a0e9405a1e0213b08cf4bdbde3beb803f5dba33

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/415597/

Comments