MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b
SHA3-384 hash: 92ced05c1b4fc06904ceaf4a2cc8323d2677973da8597c7d6bee6e465f4b81d5b327dee568b9f01e072dfdceeeb0e540
SHA1 hash: 6aaa9b4a679d58064325a7692d4e40e1a867ab1c
MD5 hash: 107fabd45e1943d57f723b56fba91b00
humanhash: timing-connecticut-ohio-timing
File name:Saudi aramco tender documents-BOQ and ITB.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'318'912 bytes
First seen:2021-07-06 05:11:46 UTC
Last seen:2021-07-06 05:35:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:1O/Vj6NsBXOaDaDa60/vSCookFi8URVvNEscaSa9:1y6NUOaDaDapvSCoobz3caSa9
Threatray 98 similar samples on MalwareBazaar
TLSH 94559DB16861465ADC6FCE34C3326E3C0FA77E79FD4FA6396944718B32A76830922513
Reporter cocaman
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Saudi aramco tender documents-BOQ and ITB.exe
Verdict:
Malicious activity
Analysis date:
2021-07-06 05:12:30 UTC
Tags:
evasion trojan snakekeylogger keylogger
Link:
https://app.any.run/tasks/faa2f152-2e3a-40f5-b495-1280e49870f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/169832/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.908.20613.22714.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35ef7d10-4340-4343-86a6-a6e795a3c68e
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/812032
Signature
.NET source code references suspicious native API functions
Found malware configuration
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-05 08:06:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdexlnaprkhvfkrxfmhovhhgatzvxhsrag2kvwr73iglwlrfeknq._file
Verdict:
malicious
Similar samples:
49793c0e162eb58b6d48edd89bad3964bee44f9669442c26671da2ad35dd6406
SnakeKeylogger
59d43607b1bc8864486706c222c900ed71eb5a820dfbf85b5ef060dca95db133
SnakeKeylogger
61746b9dafb79e16f8596f5cc55293042ff30813eb717ce28798db708204006c
SnakeKeylogger
79ebc990200b19fd71c8edfb612e35858831ca166d03ab90c5348b9124000894
SnakeKeylogger
812f68851a0237986ff6d67142ef28113eba14a0a8410e339b81e4f38d2f6774
SnakeKeylogger
a3d13d3ae0ea1df687a6bd7a84db21340a3c23df83c1c55da4aae1d61d65f6b9
SnakeKeylogger
a8f581b584bdf1bc08a22728c89aab6a460419115166aea4154f5de4e685a1e2
SnakeKeylogger
ab8acef9d760e5d0d7a7647aa054ca1a6910d31d83ce98a6b3e3d898ca3b1a0a
SnakeKeylogger
f8c19b09ac1db986888e605edf365c2900b8e88112cde564ecf8fa9e279c2d7f
SnakeKeylogger
f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685
SnakeKeylogger
+ 88 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210706-y2s33sw7ca/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Snake Keylogger
Unpacked files
SH256 hash:
2cc60904a9701bc61f73f79f132c2325071157ea75d62b227252ab7021538a50
MD5 hash:
23026e8bbdf0c3be03514513aaea575a
SHA1 hash:
a978c62dbabedc2d7373a7761e772a56ed7c252d
Link:
https://www.unpac.me/results/c7a48021-afde-4451-99fd-447ac17f3dae/
SH256 hash:
5209992fd1f96cd1959efb5e1afa71f5c9ae2ab4430e258fe9d0ec915098d110
MD5 hash:
257ca10e5cbb2f8bdf0ae6f3e900e11e
SHA1 hash:
9d25ee80dbe3bbce5ab4479912c5e21b19b6aeec
Link:
https://www.unpac.me/results/c7a48021-afde-4451-99fd-447ac17f3dae/
SH256 hash:
6fcc9f365b067b50afed7c396067bd942d2e29bbdc9b1b8ad8e58fe1bfa7f65a
MD5 hash:
abdf40529b349134c22dc0b40bef5fb3
SHA1 hash:
1cc6e8db6e07fa9a8d8053f224d3117f99383507
Link:
https://www.unpac.me/results/c7a48021-afde-4451-99fd-447ac17f3dae/
SH256 hash:
b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b
MD5 hash:
107fabd45e1943d57f723b56fba91b00
SHA1 hash:
6aaa9b4a679d58064325a7692d4e40e1a867ab1c
Link:
https://www.unpac.me/results/c7a48021-afde-4451-99fd-447ac17f3dae/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 6b5ae330c1263b282d032e40602e846e908964c4ccd8605fb8a65971159a51b3

SnakeKeylogger

Executable exe b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 6b5ae330c1263b282d032e40602e846e908964c4ccd8605fb8a65971159a51b3
Cape
Cape
https://www.capesandbox.com/analysis/169832/

Comments