MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d
SHA3-384 hash: 6f94fe4f0e7bb9761536bbd703787fc414ff54e93da56cb37ca60222c1adc99da7c6a4abc7f7483fd73e3861e0f5061d
SHA1 hash: e3fd611101e662118a369e5e91b1fb4c375d60a5
MD5 hash: 16d3e426535f97290b0a54a8a62b4901
humanhash: march-bakerloo-lamp-summer
File name:Halkbank_Ekstre_20230321_080804_358439.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:11'264 bytes
First seen:2023-07-17 06:07:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 192:G0zfp/HA4tBn3b52fprrrrrrrrrrrrrrrrrrrrelyD:G0V/HvtB3dKprrrrrrrrrrrrrrrrrrrm
Threatray 5'366 similar samples on MalwareBazaar
TLSH T1913260C17385C5ABE2608D74ACA183D00B19BD69FD647DB738CDB72F69222C409B23E1
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon a0a2a2a2a2a0a485 (2 x SnakeKeylogger, 1 x Neshta)
Reporter abuse_ch
Tags:exe geo Halkbank SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Halkbank_Ekstre_20230321_080804_358439.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-07-17 06:09:48 UTC
Tags:
snake
Link:
https://app.any.run/tasks/011615fe-1d53-430a-975b-864c3b780fab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/422123/
Detection(s):
SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Sending an HTTP GET request
Reading critical registry keys
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64b4dac787b3dbad8aacdc7b/reports/09ad909c-64bb-4de0-bbe5-26e4f9b3a318/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20ff3e85-c323-46b5-9e6e-f2f72fcc22ac
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1274221
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected MSILDownloaderGeneric
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1274221 Sample: Halkbank_Ekstre_20230321_08... Startdate: 17/07/2023 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 10 other signatures 2->55 6 Halkbank_Ekstre_20230321_080804_358439.pdf.exe 16 5 2->6         started        11 Hzlyaowldiv.exe 14 5 2->11         started        13 Hzlyaowldiv.exe 4 2->13         started        process3 dnsIp4 29 cdn.discordapp.com 162.159.135.233, 443, 49680 CLOUDFLARENETUS United States 6->29 23 C:\Users\user\AppData\...\Hzlyaowldiv.exe, PE32 6->23 dropped 25 C:\Users\...\Hzlyaowldiv.exe:Zone.Identifier, ASCII 6->25 dropped 27 Halkbank_Ekstre_20..._358439.pdf.exe.log, ASCII 6->27 dropped 57 May check the online IP address of the machine 6->57 59 Injects a PE file into a foreign processes 6->59 15 Halkbank_Ekstre_20230321_080804_358439.pdf.exe 2 6->15         started        31 162.159.130.233, 443, 49683, 49684 CLOUDFLARENETUS United States 11->31 61 Multi AV Scanner detection for dropped file 11->61 63 Machine Learning detection for dropped file 11->63 19 Hzlyaowldiv.exe 11->19         started        21 Hzlyaowldiv.exe 13->21         started        file5 signatures6 process7 dnsIp8 33 checkip.dyndns.org 15->33 35 checkip.dyndns.com 132.226.247.73, 49682, 49686, 80 UTMEMUS United States 15->35 37 192.168.2.1 unknown unknown 15->37 39 checkip.dyndns.org 19->39 41 132.226.8.169, 49685, 80 UTMEMUS United States 19->41 43 checkip.dyndns.org 21->43 45 Tries to steal Mail credentials (via file / registry access) 21->45 47 Tries to harvest and steal browser information (history, passwords, etc) 21->47 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-17 03:14:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
19 of 37 (51.35%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wisogkjxzdgozrjkyhtniecnkc7do3d6ugsgvar3apib4rf624gq._file
Verdict:
malicious
Similar samples:
0dfed6a80612475d64b34d2c0264f41ee06da61747fd3086786bcbc61212daf3
SnakeKeylogger
2cb7c9dc87cd618a4a307a8f7a054fc0acbb375e0dc2b3d041e5f5b9f138b601
SnakeKeylogger
3105a7886bb62b4a95672ed5a801e8063dfba87139195dfc5a7cfe32f3b4edf2
SnakeKeylogger
5d6c03383955c4784c08bcc14b863537f7fb451fd94a1fe7706b84576fb3819b
SnakeKeylogger
9027995cb652dafdfd860fe0019a3e60817530e46d7f6d8d8640f9241f625ef8
SnakeKeylogger
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SnakeKeylogger
e5fe74a699fdee524980b0ccdfe82a6a98abd5c011ba909822455b831720b686
SnakeKeylogger
+ 5'356 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/230717-gvwscabb6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d
MD5 hash:
16d3e426535f97290b0a54a8a62b4901
SHA1 hash:
e3fd611101e662118a369e5e91b1fb4c375d60a5
Link:
https://www.unpac.me/results/d9338592-8e04-49ee-94a3-0c05b0e7a066/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b224e32937c8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:MSIL_TinyDownloader_Generic
Create hunting rule
Author:albertzsigovits
Description:Detects small-sized dotNET downloaders
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Discord_Attachments_URL
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe b224e32937c8ccecc52ac1e6d4104d50be376c7ea1a46a823b03d01e44bed70d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/422123/

Comments