MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150
SHA3-384 hash: be91161af218c53a05572d670cdae46374c506672c58cff84a2f35c6470ac3f92f292e435c4b9087b76c2c49dccef1be
SHA1 hash: e14dd57cbfc49176c0d7d998069a43663fcfcab7
MD5 hash: bd05b2a13f8fac2c69a33d774ee21aae
humanhash: shade-hotel-angel-music
File name:FOTOĞRAF.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'014'784 bytes
First seen:2023-07-24 09:06:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:U0vJRBusyl1PJEWu1hGQbEYjz0kkJhZJCihIc/VwWvkYaxr:ZFuXJE7E/YH4tciycdF36r
Threatray 5'387 similar samples on MalwareBazaar
TLSH T15F257FD1B150CD9AED6B0AF1AD2AA53015A37E9C54A4C10C5AAD7B573AF3342309FE0F
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
294
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FOTOĞRAF.exe
Verdict:
Suspicious activity
Analysis date:
2023-07-24 09:11:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c6e7b772-b620-451c-8fe5-f937b0e8c69c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/430638/
Detection(s):
SecuriteInfo.com.Variant.Ransom.Loki.24223.31980.30301.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching the default Windows debugger (dwwin.exe)
Gathering data
Verdict:
Malicious
Labled as:
Ransom.Loki.Generic
Link:
https://www.hybrid-analysis.com/sample/b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/007736fc-7bb6-48ff-9aeb-d95237e693f0
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1278176
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-24 06:34:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
32
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ws4etmw5qw45en2xcjumet5zoearhtoi3rdrdgb4y6cbx734efia._file
Verdict:
malicious
Similar samples:
269112122917fb39eb97b3e5b00dce49486adaf1d1417dabdbb0bf0edb52aa09
SnakeKeylogger
2f0c79ee01767d02ed23922dd9d7c12715c971029fc61466629c79908385d85b
SnakeKeylogger
3105a7886bb62b4a95672ed5a801e8063dfba87139195dfc5a7cfe32f3b4edf2
SnakeKeylogger
3dedd91d5d734fdea8fa04714e99b1fdcac4c06626ad2e10aa825e71fc18c3c3
SnakeKeylogger
45a15ea41879782dd9c2991c24691c58a76031392677e65e95ec5ed987e99d13
SnakeKeylogger
5d6c03383955c4784c08bcc14b863537f7fb451fd94a1fe7706b84576fb3819b
SnakeKeylogger
6e6f28265a65efc29248f1bc10513f4c2320edba637d87f8341df71fa113dcd3
SnakeKeylogger
cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78
SnakeKeylogger
ebee69a6ec18f54b490457eb4cbc49e9394f1d2128044c1545ea6eb92b515dab
SnakeKeylogger
+ 5'377 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230724-k3bc6ace4t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/f833d1e0-f97e-4158-9136-6458e325607a/
SH256 hash:
b6b62aab40afe6be7222472baaa10cd9692ee65dde62a40758ee83a5e36fd528
MD5 hash:
b8f1b1249a836be47a77480c5f73f913
SHA1 hash:
5e75aaa21d1e3378bc78caa43ac7abc3ad623bdd
Link:
https://www.unpac.me/results/f833d1e0-f97e-4158-9136-6458e325607a/
SH256 hash:
434f37199f72097b15405d6214e00f2843e87f1befec097079f1471764910268
MD5 hash:
5aa57c2de7e265366591781e26032cda
SHA1 hash:
13d7676b5bccd72742a889357db4274b922c55e6
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/f833d1e0-f97e-4158-9136-6458e325607a/
Parent samples :
71a0f6429f7199e64b3c6d852696a9a8721e6f95598e279f276cfdf22db4e5b5
b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150
4d87691cc9ee123c1601b86054119c8a202d3f77b51b78306547d900b6a6b7c8
393242de003f1c79e502bfe5b8b073f2ce1f423d5871a2261bdeffd823f8c266
a44d262ed7c8085b22ad15653bd2a7d3ecc966c3e7c54252de5670ce64027847
SH256 hash:
e6f6d4537b5a06dcaa639efb0f59ad138130ef4c513244de3546a5738c0ebed3
MD5 hash:
04c1c72fcdab1c3639a9bedb97400004
SHA1 hash:
0e02ae80df4243f81292cbfbed7037f171aaf544
Link:
https://www.unpac.me/results/f833d1e0-f97e-4158-9136-6458e325607a/
SH256 hash:
b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150
MD5 hash:
bd05b2a13f8fac2c69a33d774ee21aae
SHA1 hash:
e14dd57cbfc49176c0d7d998069a43663fcfcab7
Link:
https://www.unpac.me/results/f833d1e0-f97e-4158-9136-6458e325607a/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b4b849b2dd85/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe b4b849b2dd85b9d237571268c24fb9710113cdc8dc4711983cc7841bff7c2150

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/430638/

Comments