MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3705dc14785978cfa26ca25bdda43e5a66286fd2970b2d839b9b2bec4064717. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	b3705dc14785978cfa26ca25bdda43e5a66286fd2970b2d839b9b2bec4064717
SHA3-384 hash:	29f6aff2154f16557a094e5fc00fdab4d582cb519a2b00fdd7a3e49a17c3f176ccdb27290407a739f0be2a512cc1b57a
SHA1 hash:	0c60c39346484b6098c00640428547b528b6d311
MD5 hash:	ab49739d0b47bce0511fb52a9570b362
humanhash:	massachusetts-west-mirror-california
File name:	ab49739d0b47bce0511fb52a9570b362.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	76'800 bytes
First seen:	2022-02-08 17:08:40 UTC
Last seen:	2022-02-08 18:56:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	1536:156byTvWMS0F/9qjXwP9JqRWIgiJ3ur2w:156bBk/96+JqRWIgiJ3urn
Threatray	6'973 similar samples on MalwareBazaar
TLSH	T1B973CBE162DB4AC9C4342975C61483702568AC7F9930DA927CA83F8754B7DC79CBECB2
File icon (PE):
dhash icon	00c4c4d4dcdec200 (2 x SnakeKeylogger)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

abuse_ch

Payload URLs:
http://3.112.243.28/net/Ugrfa.bat
http://3.112.243.28/net/Ugrfa.log

Intelligence

File Origin

# of uploads :

# of downloads :

172

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/238391/

Detection(s):

SecuriteInfo.com.Trojan.DownloaderNET.304.3761.5975.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Running batch commands

DNS request

Sending an HTTP GET request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/6202a42ac79b424d7208ccfc/reports/baeffd1a-7215-483e-ac88-f1440f34b95e/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/3217c0cf-1f77-405d-9a72-68dbebb2fc8f

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/936224

Behaviour

Behavior Graph:

n/a

Detection:

snakekeylogger

Link:

https://mwdb.cert.pl/sample/b3705dc14785978cfa26ca25bdda43e5a66286fd2970b2d839b9b2bec4064717/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-02-08 17:09:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Verdict:

malicious

SnakeKeylogger

29704c1c8f22aefdd760c85d19b71aa22fd35e0506804d629c92611f3df072bc

SnakeKeylogger

2dd269cf117a37d4c7fe03686f7fbc935de3bffcc316bd0352fea4811e6a6cb6

SnakeKeylogger

342506c44d37429ab7b60aac7769abcec411f8013ea3fb88202fefe784c50c35

SnakeKeylogger

6d609fc45514bf9f9ca417aac9f42b01e72300f5c1dafe46dd58f72ab51b81b9

SnakeKeylogger

6f63f6b701569423d41f2172ef070360c2b0dea60df2fb988d7633cc44bbbfa4

SnakeKeylogger

9d8a220a6e3de86924137cc074e02d98c2a4f349644ac22a865c0369182d00d8

SnakeKeylogger

a5873f85a8a3800eb3385730aa55e42df0e5a420b6d7bdfb7934a0872faebd4a

SnakeKeylogger

d2d9084a238e2b96bd743f6e954fc387e3060f3316daf113c9c88f8a7c059c45

SnakeKeylogger

d73d8f99a6704f43c0caaf0b6deb99b3f342f645765bf5ca94f41d5daea31612

SnakeKeylogger

+ 6'963 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger persistence spyware stealer

Link:

https://tria.ge/reports/220208-vn4fhabefj/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

b3705dc14785978cfa26ca25bdda43e5a66286fd2970b2d839b9b2bec4064717

MD5 hash:

ab49739d0b47bce0511fb52a9570b362

SHA1 hash:

0c60c39346484b6098c00640428547b528b6d311

Link:

https://www.unpac.me/results/8b721d08-8111-4835-b4a3-334d40bb5f56/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.