MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af530371b4be2eb16df4aef4f67b47429193dda3a33eb912c13ff0d492632fe6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af530371b4be2eb16df4aef4f67b47429193dda3a33eb912c13ff0d492632fe6
SHA3-384 hash: 197c80d3c82bd4a46e1387113176965db0bad447e4e5fd9235f84a61bcb6ddc8d5b22b3aaf79b5e31c0ab064b580b496
SHA1 hash: 346c99cdcf9f092c4b9b4f879e6db83d9a36c552
MD5 hash: bbea5cf31b7051fb1b50779db9889384
humanhash: bulldog-football-florida-twelve
File name:RFQ#1952022(BOQ-IT-Equipment.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:521'216 bytes
First seen:2022-05-16 08:32:56 UTC
Last seen:2022-05-16 13:32:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Sw/GSr7DE4qRU+JorCcgHimabo0Fcy4YiKHa+DxnrRat6Q:j/NnEOWczV8
Threatray 4'638 similar samples on MalwareBazaar
TLSH T1FCB4E0AC7164B6EFC85BD4769A992C74EA61747B431B9203D45340EEAE0D987CF240F3
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon c0b0c6c8a896a0c0 (20 x AgentTesla, 19 x Formbook, 12 x Loki)
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
13
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ#1952022(BOQ-IT-Equipment.pdf.exe
Verdict:
Malicious activity
Analysis date:
2022-05-16 08:59:52 UTC
Tags:
evasion trojan snake keylogger
Link:
https://app.any.run/tasks/8b856fa5-de74-4629-be85-0a65efea6785

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/270944/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62820c40fd71ca8b2ee43d18/reports/26bc5405-bd89-403b-89ed-2a951663a726/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb0f3c35-b722-4b58-83d3-1a06c8915e19
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/994700
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af530371b4be2eb16df4aef4f67b47429193dda3a33eb912c13ff0d492632fe6/
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2022-05-16 06:38:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 41 (53.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v5jqg4nuxyxlc3puv32pm62hikizhxndum7lsewbh7ynjetdf7ta._file
Verdict:
malicious
Similar samples:
119e4387c730d77226134d71e01db6a53f4eebbda8aeebf0ce9120003237b241
SnakeKeylogger
2b317db474aaa5798fa907d94e7d1cd8a284386c988c924c9f5dd156f21ebc54
SnakeKeylogger
5e643893de51d86d322c275fa035eb34adcc04ab0fda29c66ed43c14787ab705
SnakeKeylogger
7501983c1a978a1a77485daf4811f9bebe31c18f28d95d456402b27860289c1f
SnakeKeylogger
7905618d53c7c0d9b949044ac76a711aed6ab9a5b6e7156c08871637a2858666
SnakeKeylogger
a2740d771fd485b1010c57895ae92798ab9b7f06f9e21808c49dadd0557c64c4
SnakeKeylogger
b189ba60839a515b25f12ed2af1f67f2874806e23611ee8d12584d07db10b4b9
SnakeKeylogger
bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15
SnakeKeylogger
fec889ae8aee9a919471ea23e1603d9f76be40fb90b9298a8e7c607263acdd1b
SnakeKeylogger
+ 4'628 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/220516-kfvhhsadhj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
819e9115379913f425c9cee417a1f1781fe018fc70c911011a4338999e0a3641
MD5 hash:
93e35079ba0425d7b3c40fb276542f62
SHA1 hash:
e8d7c5f3788cd12087bdb82e60b973a93dff6a67
Link:
https://www.unpac.me/results/882ccdc7-afdc-40c9-9a90-c1bc0a62cc3c/
SH256 hash:
23d1bf6a661e0aa4907e828d66517737483662e4041b61f236eb7c1bdbf56c2d
MD5 hash:
e7bd8771ff561b175ada7e971c419647
SHA1 hash:
75f36570a89d546e44df2c7af5c1bcfabb1ae552
Link:
https://www.unpac.me/results/882ccdc7-afdc-40c9-9a90-c1bc0a62cc3c/
SH256 hash:
8ba117734ffa3a0474b95ce5529ac723e741bfc932213295077974271a61561f
MD5 hash:
81f87a01fc648e5a628606c20205e038
SHA1 hash:
40e383a43caf1a9e846b586e4447d1a8f0b147ea
Link:
https://www.unpac.me/results/882ccdc7-afdc-40c9-9a90-c1bc0a62cc3c/
SH256 hash:
709fdbef8932044e42231f14888aa12b12ddc571e6daba8af86d624a39fa63bf
MD5 hash:
a7a6647650fe0204d1ab042824d638be
SHA1 hash:
a1194aba19ab6190a412073fe1918cd1b559aacf
Link:
https://www.unpac.me/results/882ccdc7-afdc-40c9-9a90-c1bc0a62cc3c/
SH256 hash:
af530371b4be2eb16df4aef4f67b47429193dda3a33eb912c13ff0d492632fe6
MD5 hash:
bbea5cf31b7051fb1b50779db9889384
SHA1 hash:
346c99cdcf9f092c4b9b4f879e6db83d9a36c552
Link:
https://www.unpac.me/results/882ccdc7-afdc-40c9-9a90-c1bc0a62cc3c/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/af530371b4be/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/af530371b4be2eb16df4aef4f67b47429193dda3a33eb912c13ff0d492632fe6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

xz 9f7bd53d973f258aee019c5d5dca551673da3051bf2c3e586019edae9f895964

SnakeKeylogger

Executable exe af530371b4be2eb16df4aef4f67b47429193dda3a33eb912c13ff0d492632fe6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/270944/
  
Dropped by
SHA256 9f7bd53d973f258aee019c5d5dca551673da3051bf2c3e586019edae9f895964
  
Dropped by
MD5 57436c8420a9fa776e7e7d1f4f508fe2
  
Dropped by
SHA256 305430bdff7037ba0b8f99ba6c2aa5518c0d27b7d691b4a0d335a4e3a30a14e9
  
Dropped by
MD5 b65007dd03583e7e7e39a3f49f8bdfb4

Comments