MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b062dff5d70847fbec0f252db14092f1e28a45f9069d0e1b26632222da2e2741. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Maldoc score: 11


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b062dff5d70847fbec0f252db14092f1e28a45f9069d0e1b26632222da2e2741
SHA3-384 hash: ab1c91882524486d3120a2f9dda54335ddf90a808596ce3d8039cd49195fcad9e3f8dcd9f16b99a170999e7ba98ad31a
SHA1 hash: 903accc35e9abd4994a5e36aa0165ac65396a107
MD5 hash: 321bfe330a10dc1f615e5c9d69218c57
humanhash: nine-lima-harry-sweet
File name:PO10976 B86b0mDlYqpH2306105pdf.doc
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:645'632 bytes
First seen:2021-10-29 05:13:14 UTC
Last seen:Never
File type:Word file doc
MIME type:application/msword
ssdeep 12288:TbqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:nmukI6Y+N7uDgl6gI9VAm5vzs
TLSH T10FD42392B1D4DF9BE41B66391CC3D09C7E18FC889E6DD20B3A45BB5F4EB97268102819
Reporter abuse_ch
Tags:doc SnakeKeylogger

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
OLE dump

MalwareBazaar was able to identify 12 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
24096 bytesDocumentSummaryInformation
34096 bytesSummaryInformation
47019 bytes1Table
5610223 bytesData
6412 bytesMacros/PROJECT
765 bytesMacros/PROJECTwm
81001 bytesMacros/VBA/Module1
92146 bytesMacros/VBA/ThisDocument
102693 bytesMacros/VBA/_VBA_PROJECT
11562 bytesMacros/VBA/dir
124096 bytesWordDocument
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecDocument_OpenRuns when the Word or Publisher document is opened
IOCgod.batExecutable file name
SuspiciousOpenMay open a file
SuspiciousCreateTextFileMay create a text file
SuspiciousGetObjectMay get an OLE object with a running instance
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/msword
Has a screenshot:
False
Contains macros:
True
Detection(s):
TwinWave.GetObjectStringManipulationDontMessAroundWithJim.20200804.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.HTTP
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.START-BITSTRANSFER.210729.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD..EXE.211019.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.blankopen.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy Word File with Macro
Link:
https://app.docguard.net/b062dff5d70847fbec0f252db14092f1e28a45f9069d0e1b26632222da2e2741/results/dashboard
Document image
Image:
Download PNG
Document image
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b062dff5d70847fbec0f252db14092f1e28a45f9069d0e1b26632222da2e2741
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Macro with File System Write
Detected macro logic that can write data to the file system.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Result
Threat name:
Clipboard Hijacker Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
expl.evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879011
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary or sample is protected by dotNetProtector
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Detected unpacking (overwrites its own PE header)
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (creates forbidden files)
Document exploit detected (process start blacklist hit)
Found detection on Joe Sandbox Cloud Basic with higher score
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Execution from Suspicious Folder
Sigma detected: Microsoft Office Product Spawning Windows Shell
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Yara detected Obfuscated Powershell
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 511450 Sample: PO10976 B86b0mDlYqpH2306105... Startdate: 29/10/2021 Architecture: WINDOWS Score: 100 67 132.226.247.73, 49856, 80 UTMEMUS United States 2->67 69 freegeoip.app 2->69 71 3 other IPs or domains 2->71 79 Malicious sample detected (through community Yara rule) 2->79 81 Antivirus detection for URL or domain 2->81 83 Antivirus detection for dropped file 2->83 85 18 other signatures 2->85 11 WINWORD.EXE 45 43 2->11         started        15 sergf.exe 2->15         started        17 FB_E78E.tmp.exe 2->17         started        19 FB_E78E.tmp.exe 2->19         started        signatures3 process4 file5 63 C:\Users\user\...\~DF755886B606C2B1B0.TMP, Composite 11->63 dropped 65 C:\Users\Public\Documents\god.bat, ASCII 11->65 dropped 101 Document exploit detected (creates forbidden files) 11->101 21 cmd.exe 1 11->21         started        103 Multi AV Scanner detection for dropped file 15->103 105 Machine Learning detection for dropped file 15->105 107 Injects a PE file into a foreign processes 15->107 109 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 15->109 24 sergf.exe 15->24         started        signatures6 process7 file8 87 Uses schtasks.exe or at.exe to add and modify task schedules 21->87 27 powershell.exe 28 21->27         started        29 conhost.exe 21->29         started        59 C:\Users\user\AppData\...\FB_7547.tmp.exe, PE32 24->59 dropped 61 C:\Users\user\AppData\...\FB_6894.tmp.exe, PE32 24->61 dropped signatures9 process10 process11 31 databed.exe 4 27->31         started        signatures12 111 Injects a PE file into a foreign processes 31->111 34 databed.exe 1 5 31->34         started        37 cmd.exe 2 31->37         started        39 cmd.exe 1 31->39         started        process13 file14 53 C:\Users\user\AppData\...\FB_E78E.tmp.exe, PE32 34->53 dropped 55 C:\Users\user\AppData\...\FB_DF21.tmp.exe, PE32 34->55 dropped 41 FB_DF21.tmp.exe 15 2 34->41         started        45 FB_E78E.tmp.exe 34->45         started        57 C:\Users\user\AppData\Roaming\...\sergf.exe, PE32 37->57 dropped 47 conhost.exe 37->47         started        49 conhost.exe 39->49         started        51 schtasks.exe 39->51         started        process15 dnsIp16 73 checkip.dyndns.com 132.226.8.169, 49826, 80 UTMEMUS United States 41->73 75 freegeoip.app 104.21.19.200, 443, 49827, 49857 CLOUDFLARENETUS United States 41->75 77 2 other IPs or domains 41->77 89 Antivirus detection for dropped file 41->89 91 Multi AV Scanner detection for dropped file 41->91 93 May check the online IP address of the machine 41->93 99 3 other signatures 41->99 95 Detected unpacking (overwrites its own PE header) 45->95 97 Machine Learning detection for dropped file 45->97 signatures17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b062dff5d70847fbec0f252db14092f1e28a45f9069d0e1b26632222da2e2741/
Threat name:
Document-Word.Downloader.Powdow
Create hunting rule
Status:
Malicious
First seen:
2021-10-29 05:14:09 UTC
AV detection:
17 of 44 (38.64%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbrn75oxbbd7x3apeuw3cqes6hriurpza2oq4gzgmmrcfwroe5aq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger macro macro_on_action persistence spyware stealer
Link:
https://tria.ge/reports/211029-fw1l9ahchr/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Process spawned unexpected child process
Snake Keylogger
Malware Config
Dropper Extraction:
http://coachcarmenwilliams.com/B86b0mDlYqpH2306105pdf.exe
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b062dff5d70847fbec0f252db14092f1e28a45f9069d0e1b26632222da2e2741

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments