MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b48c018d252b5974a13a65c6b67856d4f2059a90499f65037a63324e4a42001c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 11
| SHA256 hash: | b48c018d252b5974a13a65c6b67856d4f2059a90499f65037a63324e4a42001c |
|---|---|
| SHA3-384 hash: | 4d440d7fecf4734635115c5665a33756bff26c7e03ba9cf2435d04ced41e88050fe9c59c8bba43f9be9e6aff4c1b01ed |
| SHA1 hash: | 241ea564df31ce4426be03ee04a1bc36fd0a4a8d |
| MD5 hash: | 53d21c314982f1a094475dc6b2e5cf85 |
| humanhash: | nebraska-lactose-fourteen-kilo |
| File name: | HRACAT BELGELERİ.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 917'504 bytes |
| First seen: | 2022-05-20 12:25:38 UTC |
| Last seen: | 2022-05-20 12:48:09 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'628 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:c9nEsJlLx0MHfr7RfNXPbNJL4xrB81jzMH:9mLx0M/nRfNXjNlAojzMH |
| Threatray | 3'504 similar samples on MalwareBazaar |
| TLSH | T1DC155DD1B1908C96E86F09F1BD2AA43015E7BE9D64A4810D569DBB1B36F3342209FF1F |
| TrID | 54.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 23.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 7.8% (.EXE) Win64 Executable (generic) (10523/12/4) 4.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.3% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | exe geo SnakeKeylogger TUR |
Intelligence
File Origin
# of uploads :
2
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
HRACAT BELGELERİ.exe
Verdict:
Suspicious activity
Analysis date:
2022-05-20 21:02:51 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code references suspicious native API functions
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-05-20 07:47:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
19 of 26 (73.08%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 3'494 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
187700e1704dbfc438d8e0e47ed6d15b4d4e0bffa638216eddfcc51ec0a2d617
MD5 hash:
3a0fe46229da323fff01b7e23b6c484b
SHA1 hash:
f795f8ad1a08e3ab98bc3db2b51683fdfba99f66
SH256 hash:
4d3ac9ddb56d1ac3279c1b64af46d4d092ae6493b625535d1e5c2e5989083148
MD5 hash:
80bcde66d075b3a9f9e49c349d9f1ef0
SHA1 hash:
f5b928318b6c39b2e2ad5f9048ffd01f07e59c6d
SH256 hash:
dc1172cffc1869465b685cd51feb19839c86e2a73a95dfd56bcdfe744505f520
MD5 hash:
9c4b15703e036a63bc459e89950efdd5
SHA1 hash:
46c584c41f37c362add336651d293b532cb5715d
SH256 hash:
2f4fff7256e861d6521c2d1b1d562f50bb5bf2dc781592db2d88e80ebbfa63d0
MD5 hash:
adc1b0d2b1316cfeaa5e9a7f1bf5c9eb
SHA1 hash:
0c1424fff126641ee41af1f0372aeaf9c44069ee
SH256 hash:
b48c018d252b5974a13a65c6b67856d4f2059a90499f65037a63324e4a42001c
MD5 hash:
53d21c314982f1a094475dc6b2e5cf85
SHA1 hash:
241ea564df31ce4426be03ee04a1bc36fd0a4a8d
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.