MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67
SHA3-384 hash: 95ef495c4318796c9c8a222197b52de46df9eda3ff99dc39a55b91e5d3494740bea78ba9d4f591d9026688681a98840e
SHA1 hash: 074ce11b7503e6a6431decf55d898230342274d8
MD5 hash: f3ea825d905334a99c8df44031473d7c
humanhash: carpet-batman-fruit-winner
File name:z364Gw9LE8vmxZPIgT.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:787'968 bytes
First seen:2023-05-18 17:49:02 UTC
Last seen:2023-05-20 15:32:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:0S8hue/3H1LdQu7XncexwHlrj+rp10qYyEpzZxRijb5X7mod0NcHiYjjF:0BLdQu7Rqlral10qj6oLb0uj
Threatray 1'431 similar samples on MalwareBazaar
TLSH T188F4AD20A2ACDF1AE03A93F544A1D1B447F54EAA747ED7478EC27DCB3AA4F214650B43
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon b1b1b17964989c06 (31 x SnakeKeylogger, 4 x AgentTesla, 3 x XWorm)
Reporter FXOLabs
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
274
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Re New Order 957KHS634.bz
Verdict:
Malicious activity
Analysis date:
2023-05-18 16:52:44 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/b871e8ed-7dd7-41ae-a2e2-68e45b190145

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Strictor.277576.29224.8115.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/6466651075f687672ac67e6a/reports/34d07227-3cb4-4525-8ee2-ae31ecc14420/overview
Verdict:
Malicious
Labled as:
Strictor.Generic
Link:
https://www.hybrid-analysis.com/sample/aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f5b0019f-8c25-469d-8b6b-1d26cf240bdb
Result
Threat name:
Snake Keylogger, StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1236214
Signature
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 869215 Sample: z364Gw9LE8vmxZPIgT.exe Startdate: 18/05/2023 Architecture: WINDOWS Score: 100 51 Snort IDS alert for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 8 other signatures 2->57 7 z364Gw9LE8vmxZPIgT.exe 7 2->7         started        11 WXUYowHBBeuDfU.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\...\WXUYowHBBeuDfU.exe, PE32 7->35 dropped 37 C:\...\WXUYowHBBeuDfU.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmp44E7.tmp, XML 7->39 dropped 41 C:\Users\user\...\z364Gw9LE8vmxZPIgT.exe.log, ASCII 7->41 dropped 59 May check the online IP address of the machine 7->59 61 Uses schtasks.exe or at.exe to add and modify task schedules 7->61 63 Adds a directory exclusion to Windows Defender 7->63 13 z364Gw9LE8vmxZPIgT.exe 15 2 7->13         started        17 powershell.exe 20 7->17         started        19 schtasks.exe 1 7->19         started        21 z364Gw9LE8vmxZPIgT.exe 7->21         started        65 Multi AV Scanner detection for dropped file 11->65 67 Machine Learning detection for dropped file 11->67 69 Injects a PE file into a foreign processes 11->69 23 WXUYowHBBeuDfU.exe 11->23         started        25 schtasks.exe 1 11->25         started        27 WXUYowHBBeuDfU.exe 11->27         started        signatures5 process6 dnsIp7 43 checkip.dyndns.com 193.122.130.0, 49694, 49699, 80 ORACLE-BMC-31898US United States 13->43 45 checkip.dyndns.org 13->45 49 2 other IPs or domains 13->49 29 conhost.exe 17->29         started        31 conhost.exe 19->31         started        47 checkip.dyndns.org 23->47 71 Tries to steal Mail credentials (via file / registry access) 23->71 73 Tries to harvest and steal browser information (history, passwords, etc) 23->73 33 conhost.exe 25->33         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-18 15:28:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v3a7vqwwxn6gisva2nf4g7cksvix7zhzao4zwqz7dfn62uhpxztq._file
Verdict:
malicious
Similar samples:
15e2b1d8d7ec96acece7e015ec8588bec907b02945c8e20e59c1e84c039bae69
SnakeKeylogger
164e737095c31ab5c5d9ad0cf5b410ca75ddd968da6ef7b3051970ad517b9a93
SnakeKeylogger
203495007a95ee6a8fd76e9e4b910e55c7126c1484a31b464b3f5206c6bfa388
SnakeKeylogger
3db10778e1d0ccc415a6ad057180e3ef8025d2f9ccfa77a14f37369189526955
SnakeKeylogger
61242d372c2335940696dbf6d7ea85fbd95bd192d40a2e347faf43d9cbd04c82
SnakeKeylogger
8d2a53bd89b25935e2d8d9195f6982e3dfac315b8d77a856becc7d1aae4f66ab
SnakeKeylogger
a2350b33548abf34e63361ea80d402e3d6f83571bea91578bea7ea578e57af44
SnakeKeylogger
d0bbf51d9dc7100fb76b837b5e5ffe89b767351518e76a64fa2748463a1c89e6
SnakeKeylogger
d18cf7fcde053ba33105a836de182859fbfc493eb5185bbaddee1133b9063509
SnakeKeylogger
+ 1'421 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger family:stormkitty collection keylogger spyware stealer
Link:
https://tria.ge/reports/230518-wdz6rscb5w/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
StormKitty
StormKitty payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5900175150:AAEOWcHfBC8E-MpCblgzLaTu6oAl9xGi2Nc/sendMessage?chat_id=6236888590
Unpacked files
SH256 hash:
b964c6bb29a713916a0b2439d7c3983447017b78ce6cd52196d838ef8b724c65
MD5 hash:
1ce0e982d2f2f3d2f805b1663e5fb250
SHA1 hash:
b54077c8f3a148869380a868f3bf1e7f12b051ee
Link:
https://www.unpac.me/results/691dbee5-da4c-4103-b50d-00e55a28b580/
SH256 hash:
2907ceb0aff33154a49177d6e04e822538f3fb439a55264cdf84b162564afea6
MD5 hash:
ae06e9b9c5d6df3bdb39fbbc75d9b9cd
SHA1 hash:
b03aff7dda4462819b1250e44d80c83aca37237f
Link:
https://www.unpac.me/results/691dbee5-da4c-4103-b50d-00e55a28b580/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/691dbee5-da4c-4103-b50d-00e55a28b580/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
ca6ef34d10ed0fd88cb6bc096e55012e2423c58f46cece5d0e5b18f42c14fd60
MD5 hash:
d30f6c006b34420b606a6042485b29a6
SHA1 hash:
7da5198edf9320747406717b5a39f783a56ef1ed
Link:
https://www.unpac.me/results/691dbee5-da4c-4103-b50d-00e55a28b580/
SH256 hash:
c678d246a9bffcde7a88ea1d0eec2ccb36182b8e7655f69019cebecc6691c706
MD5 hash:
5a65c04ab4adbc2b2ba03698e0b90c5a
SHA1 hash:
1d19f8df5c1d9c3c59367834380f954e7a191648
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/691dbee5-da4c-4103-b50d-00e55a28b580/
Parent samples :
61242d372c2335940696dbf6d7ea85fbd95bd192d40a2e347faf43d9cbd04c82
aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67
0f79d5a95f0a777647c8f37dac2111cc426b2a3da30d7edaced49e980e0910a6
SH256 hash:
aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67
MD5 hash:
f3ea825d905334a99c8df44031473d7c
SHA1 hash:
074ce11b7503e6a6431decf55d898230342274d8
Link:
https://www.unpac.me/results/691dbee5-da4c-4103-b50d-00e55a28b580/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aec1fac2d6bb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe aec1fac2d6bb7c644aa0d34bc37c4a95517fe4f903b99b433f195bed50efbe67

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments