MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e
SHA3-384 hash: e45baeb651752f6e2f825dc48d209876baceefac2a9aeae5bd6c85e0519efa3e90a65572bd58cc40c6387b448ce26f26
SHA1 hash: b94ea61b837ba2cc51792d383ba3968caf4de896
MD5 hash: 7ebc9d7ca6d0e5ae24bec8272f4a00bf
humanhash: blossom-alanine-solar-princess
File name:URGENT PRICE.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'760'768 bytes
First seen:2021-09-01 14:21:05 UTC
Last seen:2021-09-05 08:39:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 332f7ce65ead0adfb3d35147033aabe9 (81 x XRed, 18 x SnakeKeylogger, 7 x DarkComet)
ssdeep 49152:znsHyjtk2MYC5GDIvRSRms8f+44oatajgCNgkUv:znsmtk2aNXT+Ogr
Threatray 792 similar samples on MalwareBazaar
TLSH T17B85E122B2D1903FC1334A3D8C5B6BA49939BE512E39B54B7BE61E4C4F3D2826D151E3
dhash icon 70c4cee1e0c2a0e1 (2 x SnakeKeylogger, 2 x Formbook)
Reporter GovCERT_CH
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
5
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
URGENT PRICE.zip
Verdict:
Malicious activity
Analysis date:
2021-09-01 13:28:55 UTC
Tags:
trojan evasion snakekeylogger keylogger
Link:
https://app.any.run/tasks/3d10af39-ffb1-45c2-bdb2-2232b30b4b4b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/184491/
Detection(s):
PUA.Win.Packer.D1s1g-5
Create hunting rule

PUA.Win.Packer.D1s1g-1
Create hunting rule

PUA.Win.Packer.D1s1g-2
Create hunting rule

Win.Malware.Delf-6899401-0
Create hunting rule

Win.Trojan.Emotet-9850453-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file
Moving a recently created file
Searching for the window
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Modifying an executable file
Deleting a recently created file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a UDP request
Sending a custom TCP request
Reading critical registry keys
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Unauthorized injection to a recently created process by context flags manipulation
Infecting executable files
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/67b08786-bdf5-41e2-9b29-4cefe6c40d35
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
expl.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/843398
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Drops PE files to the document folder of the user
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses dynamic DNS services
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 475829 Sample: URGENT PRICE.exe Startdate: 01/09/2021 Architecture: WINDOWS Score: 100 65 Found malware configuration 2->65 67 Malicious sample detected (through community Yara rule) 2->67 69 Antivirus detection for dropped file 2->69 71 16 other signatures 2->71 8 URGENT PRICE.exe 1 6 2->8         started        11 EXCEL.EXE 2->11         started        13 Synaptics.exe 2->13         started        process3 file4 35 C:\Users\user\...\._cache_URGENT PRICE.exe, PE32 8->35 dropped 37 C:\ProgramData\Synaptics\Synaptics.exe, PE32 8->37 dropped 39 C:\ProgramData\Synaptics\RCXF06F.tmp, PE32 8->39 dropped 41 C:\...\Synaptics.exe:Zone.Identifier, ASCII 8->41 dropped 15 Synaptics.exe 508 8->15         started        20 ._cache_URGENT PRICE.exe 3 8->20         started        process5 dnsIp6 49 docs.google.com 172.217.16.142, 443, 49708, 49709 GOOGLEUS United States 15->49 51 freedns.afraid.org 69.42.215.252, 49710, 80 AWKNET-LLCUS United States 15->51 53 2 other IPs or domains 15->53 29 C:\Users\user\DocumentsIVQSAOTAQ\~$cache1, PE32 15->29 dropped 55 Antivirus detection for dropped file 15->55 57 Multi AV Scanner detection for dropped file 15->57 59 Drops PE files to the document folder of the user 15->59 63 2 other signatures 15->63 31 C:\Users\...\._cache_URGENT PRICE.exe.log, ASCII 20->31 dropped 61 Injects a PE file into a foreign processes 20->61 22 ._cache_URGENT PRICE.exe 20->22         started        file7 signatures8 process9 file10 33 C:\Users\...\._cache_._cache_URGENT PRICE.exe, PE32 22->33 dropped 25 ._cache_._cache_URGENT PRICE.exe 22->25         started        process11 dnsIp12 43 checkip.dyndns.com 132.226.247.73, 49713, 80 UTMEMUS United States 25->43 45 freegeoip.app 104.21.19.200, 443, 49717 CLOUDFLARENETUS United States 25->45 47 checkip.dyndns.org 25->47 73 Tries to steal Mail credentials (via file access) 25->73 75 Tries to harvest and steal ftp login credentials 25->75 77 Tries to harvest and steal browser information (history, passwords, etc) 25->77 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e/
Threat name:
Win32.Backdoor.DarkComet
Create hunting rule
Status:
Malicious
First seen:
2021-09-01 14:22:09 UTC
File Type:
PE (Exe)
Extracted files:
69
AV detection:
40 of 45 (88.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxwh66aylj4hhawtnecjocuwgvur55qdjknmyuaqbdvyc7qr2b7a._file
Verdict:
malicious
Similar samples:
0fbdb66d81f97c74640af563b58b4d93872ed48a0397754b5c51a5c76d32900c
SnakeKeylogger
26274dd1baa5be91bd6bdb0db48895d89da2a78e6fac273257557de473adc841
SnakeKeylogger
41b5691a9272ab9dcb87a5f3f106da073fc3d2c4aea1abd78ac7b3af4cbbffdd
SnakeKeylogger
56f435a5987f429df40365c3fc9e17443e7a79a003d57d29b4b8f4396bf8c22b
SnakeKeylogger
5fa54622d0d5f5abbeec7e634d6c2d868984e8cfb20b8502757c2df8fe94f7c7
SnakeKeylogger
8c857d02af8759783d34e85f94b4f3a61a8ec6bf687b5d80668814025107466f
SnakeKeylogger
a3cbb98747178f3da58a7d44bbd672c526d1721b20ece7d92f3b85667467aa2b
SnakeKeylogger
b484b76186c0e9c0d4f8719978a2235d0f580088562df853c837e296b1d837ed
SnakeKeylogger
ff97bd0b382bcd07b0e71fd6249426a1d1246c52b07edd238eaa64136db737df
SnakeKeylogger
+ 782 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger macro persistence spyware stealer
Link:
https://tria.ge/reports/210901-9jkt8mdvqs/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Suspicious Office macro
Snake Keylogger
Unpacked files
SH256 hash:
a4a844ffd175602400f333741bc0f3582030eaebb90a19f841c855d539bd2e67
MD5 hash:
3a5c58c1a52727682465d7925559d21a
SHA1 hash:
f68665ef6139c41f5767b597924bc6bca3e2796a
Link:
https://www.unpac.me/results/82d6ec67-00f7-4075-9b15-a1d44cbf7b9b/
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
Link:
https://www.unpac.me/results/82d6ec67-00f7-4075-9b15-a1d44cbf7b9b/
SH256 hash:
0121f13363b3c903e3fdf450c1fd365cfcf6fbcb43e161babcd53da8872f7f5c
MD5 hash:
44cc48f6d178f806bca3a28b3fb4f87b
SHA1 hash:
7e37ce35a1f9b212e7fa7286f9d70a7f0dbcbcc2
Link:
https://www.unpac.me/results/82d6ec67-00f7-4075-9b15-a1d44cbf7b9b/
SH256 hash:
81f9eac76804c02f5baaa34c91b5775f965a34ad7811218d9c24e50cb6d9a90c
MD5 hash:
bae511742374b721136acaa03b0c1fa0
SHA1 hash:
215c50455b01a78ea173bbb034ddbe4b452ea734
Link:
https://www.unpac.me/results/82d6ec67-00f7-4075-9b15-a1d44cbf7b9b/
SH256 hash:
2331603d506c3775f2faf8fda993a1bba066632b92a5d0fbfb0ed20c680888d6
MD5 hash:
a7673cfa02377507286bbe2e1ff6d7a2
SHA1 hash:
5ef9581a851b02495226a09775079b9575391248
Link:
https://www.unpac.me/results/82d6ec67-00f7-4075-9b15-a1d44cbf7b9b/
SH256 hash:
b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e
MD5 hash:
7ebc9d7ca6d0e5ae24bec8272f4a00bf
SHA1 hash:
b94ea61b837ba2cc51792d383ba3968caf4de896
Link:
https://www.unpac.me/results/82d6ec67-00f7-4075-9b15-a1d44cbf7b9b/
Malware family:
Phoenix
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b5ec7f78185a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e

(this sample)

  
Dropped by
snakekeylogger
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/184491/

Comments