MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b33baba943038aa630b333eb82a3159eaa82541b26c7f942d1b452490abc0551. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b33baba943038aa630b333eb82a3159eaa82541b26c7f942d1b452490abc0551
SHA3-384 hash: b03dda9d96cd3c033b30ac25ceeb01a3770f1bade72f91cf7039acd1e7dd8040f98199d0a32197ccec29f293f7a43d3a
SHA1 hash: e88c61eeeca919e7adb8f712f79129bc3c1152a1
MD5 hash: 8b3ec9569ee57d8e7e884e0ef4edd081
humanhash: undress-washington-eleven-nineteen
File name:QUOTATION.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:664'576 bytes
First seen:2021-07-23 15:35:41 UTC
Last seen:2021-07-23 15:35:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:fzpGzx4Ja7rkYojrMmgFd/KnQvRGlol/h24BjFVovsyaUVKnp:fzpLa7oYojrMJFdCnCROOBFV4zahp
Threatray 359 similar samples on MalwareBazaar
TLSH T13BE4D079631BE714DD3883FD2858E1512BF6A01E932ED7382F98A07C6C72BBC56E0651
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTATION.exe
Verdict:
Malicious activity
Analysis date:
2021-07-23 15:51:01 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/a09ab43f-71f2-4406-8550-2a925972aaba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173681/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a052d766-ba4d-4f15-98cb-8c95263f70bf
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/820879
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b33baba943038aa630b333eb82a3159eaa82541b26c7f942d1b452490abc0551/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 15:36:16 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wm52xkkdaofkmmftgpvyfiyvt2vieva3e3d7sqwrwrjescv4aviq._file
Verdict:
malicious
Similar samples:
043c91c0f8bd07fdce3af1ccadf2afec896527684eacee91d78e7afe32173d51
SnakeKeylogger
3914a1dd5bbef9edeceffa718d5006dce7347b1a3019b452ce754605c0e32e2e
SnakeKeylogger
510a312fcfeec1d100edf69e1f8a6f0acfbb0116be390849550743a39349b84d
SnakeKeylogger
59b7b6c0abf702ed3af7efb41f41378bf126fc718606ca3ff97db27e31f9b1d7
SnakeKeylogger
9cf85e58b7cb62b39376e36ebc8fadf0c40f21ce98f36fa9016521a8158b4881
SnakeKeylogger
9fb57f10806d3f0f9d89e0b74ee8ffe7fbdb93f642619d30aac24603a27d1479
SnakeKeylogger
b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60
SnakeKeylogger
bfa0c6d6a166011476ffd4f4fa1c2c1669c273fa945f729267fa537ce7689b44
SnakeKeylogger
c2d1f5494d37cd229d820b263c934eba39bab86570c54e207730d1c84de98393
SnakeKeylogger
ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e
SnakeKeylogger
+ 349 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210723-vbc5tb6sl6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
6b9faa420d3d1a5cddcc22631097dafae8749c22b52d0ff529901a29cfd1ec0f
MD5 hash:
3b55a4673480c40b88c96a55e68adf78
SHA1 hash:
e4b0eb2580c683cdbeff89747a9c3e96c3833c99
Link:
https://www.unpac.me/results/d6f65cf2-f9ec-4ff6-ae84-8781c6572758/
SH256 hash:
0948144975d61337a66be3b710a5284c789d87c893257f123c686f97da610413
MD5 hash:
ce2a8907ac640fe9030d55c6769d1d9a
SHA1 hash:
ce17a37ac34f252d6b8812add2dd76830cedc09e
Link:
https://www.unpac.me/results/d6f65cf2-f9ec-4ff6-ae84-8781c6572758/
SH256 hash:
c9a397ad0e70e1c9fdf04a007691633b21e155efa904a691d5bb40365ace528e
MD5 hash:
4e53dbed074d49f6aa10ed33a6cc2f6c
SHA1 hash:
9c69be1e0e0f836b3617e8eb5a4bee8282dd886f
Link:
https://www.unpac.me/results/d6f65cf2-f9ec-4ff6-ae84-8781c6572758/
SH256 hash:
83d9e44d9a311ea6fdbcbd09fdc816a2067806dcacf24beb5ee786191b1a3ea1
MD5 hash:
b1a7b752b6638ee03cffe5a1dde9213e
SHA1 hash:
52d215a173d2f293990f8c12fc7f4a86330a29cb
Link:
https://www.unpac.me/results/d6f65cf2-f9ec-4ff6-ae84-8781c6572758/
SH256 hash:
b33baba943038aa630b333eb82a3159eaa82541b26c7f942d1b452490abc0551
MD5 hash:
8b3ec9569ee57d8e7e884e0ef4edd081
SHA1 hash:
e88c61eeeca919e7adb8f712f79129bc3c1152a1
Link:
https://www.unpac.me/results/d6f65cf2-f9ec-4ff6-ae84-8781c6572758/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b33baba943038aa630b333eb82a3159eaa82541b26c7f942d1b452490abc0551

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/173681/

Comments