MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3
SHA3-384 hash: a283814a5196d22a2e7ba8cd83e404d5d96a37f3ee4bb7244e80ca0dc471f575dd2e86d8b92f15786c706c6a4c77b624
SHA1 hash: 1d0b6a7590f957b4808646d447ab15d1acd5ec16
MD5 hash: ee3aa0eeaf454ceb14bad875db06d7e5
humanhash: paris-march-ink-july
File name:kesh crypted.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:282'657 bytes
First seen:2022-12-12 08:30:16 UTC
Last seen:2022-12-12 10:31:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 97318da386948415d08cef4a9006d669 (71 x Formbook, 35 x SnakeKeylogger, 26 x AgentTesla)
ssdeep 6144:akw6RSk80lceIlJVGXxoJzF4F5Xj3O626IFz9QCyxvIDBluj5Pt3LiBe8f:60mVPuuJR4FZe0EfyxvGujFt7i5f
Threatray 5'069 similar samples on MalwareBazaar
TLSH T1025402413380C5B3D9424E71E19BAEF5A6B59D21C791927723C07F7EB8313F10A2699E
TrID 92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133)
3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
1.1% (.EXE) Win64 Executable (generic) (10523/12/4)
0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon e0d0988ccca6d2e8 (9 x SnakeKeylogger, 3 x PureCrypter, 1 x AgentTesla)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
kesh crypted.exe
Verdict:
Malicious activity
Analysis date:
2022-12-12 10:27:11 UTC
Tags:
installer evasion trojan
Link:
https://app.any.run/tasks/73231b91-9d98-450d-a5b6-3d94a9c81f02

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/345347/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.4443.723.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6396e6c79a505ad9423f24e6/reports/87a94e70-b81f-407f-aff7-f05b96168343/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f4dd804c-47b9-47c5-ba5a-c8e468983b08
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1132470
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 765193 Sample: kesh crypted.exe Startdate: 12/12/2022 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus / Scanner detection for submitted sample 2->47 49 4 other signatures 2->49 7 kesh crypted.exe 19 2->7         started        10 yfxdlmmdpkinik.exe 2->10         started        13 yfxdlmmdpkinik.exe 2->13         started        process3 file4 27 C:\Users\user\AppData\...\jrjijyriap.exe, PE32 7->27 dropped 15 jrjijyriap.exe 1 2 7->15         started        57 Multi AV Scanner detection for dropped file 10->57 19 WerFault.exe 10 10->19         started        21 WerFault.exe 4 10 13->21         started        signatures5 process6 file7 29 C:\Users\user\AppData\...\yfxdlmmdpkinik.exe, PE32 15->29 dropped 37 Multi AV Scanner detection for dropped file 15->37 39 May check the online IP address of the machine 15->39 41 Maps a DLL or memory area into another process 15->41 23 jrjijyriap.exe 15 2 15->23         started        signatures8 process9 dnsIp10 31 checkip.dyndns.com 193.122.6.168, 49698, 80 ORACLE-BMC-31898US United States 23->31 33 checkip.dyndns.org 23->33 35 192.168.2.1 unknown unknown 23->35 51 Tries to steal Mail credentials (via file / registry access) 23->51 53 Tries to harvest and steal ftp login credentials 23->53 55 Tries to harvest and steal browser information (history, passwords, etc) 23->55 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3/
Threat name:
Win32.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-12-12 08:31:06 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
16 of 39 (41.03%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtjyjrf6wkdqbjokjccwpq2lz3edgg5po4prmvetqo5qnycx2srq._file
Verdict:
malicious
Similar samples:
0ab9a4a743b66d515dc9b83579a2a1a00252bc5acf727c46279fc0f09e2b2ca1
SnakeKeylogger
1a2bcdeb48f63761b003373d932fc7eea4702ed9b856a69ae44d54a625424081
SnakeKeylogger
3bd6eaf7910876056f5f594c6b15fd7a8b75c6eef0c0a76690ed49e72ea97366
SnakeKeylogger
43b25aef4da392665de83158b04b5f705a913c9dd03bf777ea66540f8bd21600
SnakeKeylogger
4542f3e10ba41a195791bce25b8093e5d984649c48a10abafee51ff95e44e8fe
SnakeKeylogger
9d4faa17adb02b020e7d9d7807a84ccb4e9285eb05f5cbae9ba7ee1e07d7b52a
SnakeKeylogger
bff2c1fe365e6a99041f12d9318e437f81d920bd1ed450e2728bc81d3f5846d9
SnakeKeylogger
f0464f5e9669b4112215874eb7df62b915fe83a00e5365da6d8ecf7be9981388
SnakeKeylogger
+ 5'059 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/221212-kep7eaah59/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5122580304:AAHkCWB9EFavZMQfS6pgdGmtEGk1zc21s0Q/sendMessage?chat_id=5138702702
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/586f08e2-71da-463d-b798-c8469e95f6bf
Unpacked files
SH256 hash:
1a07717d1acff577840c72a9e81de993e0058a8d454f4816f67273c7cd26d11b
MD5 hash:
eeb8723244bf4323cf7199fb3fcb9f9e
SHA1 hash:
475665131d7c513a6f62b5986a2ab318e8761a1d
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/e228bc98-7e11-4f47-980a-5e657e0ab4dc/
Parent samples :
b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3
b1d5ae49da3d9ff696452c791d1a45e3a6ef7715762b338707c4e8deeccde26e
70a8964eccab1bdf1d93086e8ef308aa0f9504c34c2a0321ba6eb1babc89b55f
77eba5c8f9099d4c9f2cbd300fb6d24e43c05e951860a88f17c4ffc97736453b
581c551c6629325cd764cdb54c101d3cca9150e1d22d16149d721b8e4da20e44
e6609ae5fb8180b336d2349a97518ff15ac1b7a60a022d5befd0a366040d2de4
b8a1bfdd85f3adf519fd1ba1ffbb60a4215bd3d930dfddac1caef7066fd33cef
bde58e12d41cd833eb907de3955528c3ba4ea45f7e825b6ca038f74eaf594d26
3b9b37912769526d5ca753f309018434f6d56410b88695472cdf6e948b9645f6
fbadbfd07054097238ecc6ed27a1e69e4907cbf038b4cc2ef52bd2f07085d0a9
92d153f7f41fa901887ec1494773140e4ef9b41378f2ec05deeb0ad8ec3f5d16
14105392349904938a9d2e42e5eaf8a401d2b832c89f14fb79440a7126525d57
c7d2461a20a6687bef74bfc784219676af232262762a102ae4f11765d2324210
535d74b24a5ffb30a283e855cbfdfb3509e9c94c4f97baa2f62197b221cce54f
1828a6afda383a1f6f48f9bab91e7f0d648fcef99f959b406618847c168e5325
efe80cf748bd25110797151a16a29b956213cc00a85716dae6e6008d648725dc
125ab5d56c8bc8e55483764a4fb9ad34ea9a74543e7b3a245c308703e5ee1d40
8556b28eb846e9ee99a00d6be977a7c76ff496a390e9a6f22150a6e1fb7c0d84
SH256 hash:
066363ac60c2b1076acf4f9d90b3d3da1907e814250036608760b90bd9e11ba4
MD5 hash:
f3504522c3395822ee874e51da05e502
SHA1 hash:
21c00b6385c567c69138c98e711f19039b0f2d81
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/e228bc98-7e11-4f47-980a-5e657e0ab4dc/
SH256 hash:
b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3
MD5 hash:
ee3aa0eeaf454ceb14bad875db06d7e5
SHA1 hash:
1d0b6a7590f957b4808646d447ab15d1acd5ec16
Link:
https://www.unpac.me/results/e228bc98-7e11-4f47-980a-5e657e0ab4dc/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b4d384c4beb2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AsyncRat_Detection_Dec_2022
Create hunting rule
Author:Potatech
Description:AsyncRat
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe b4d384c4beb28700a5ca488567c34bcec8331baf771f16549383bb06e057d4a3

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/345347/

Comments