MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce
SHA3-384 hash: 19bdd2ee8fee0052b522dd19996f1491437f7777a611a7caa50c9614d6325d3af950b89d0426f4e42af89cf79ca75c26
SHA1 hash: 78063654eccb02bfccc5f327eb2ab134c8d2d6a5
MD5 hash: cd6076d8675c857ae061c0731c45566b
humanhash: magazine-pennsylvania-magnesium-summer
File name:INVOICES.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'054'208 bytes
First seen:2022-12-10 08:27:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:77wnJd8xuih7mmMZXEmkpBcph5rYt66pF0f:7U8uih7m7R1phlYk
TLSH T13C255BD1B7F6A126F58B32712018768DED35BD037647A14A27763B4082F58FFAAB8443
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 0703030131050141 (15 x SnakeKeylogger, 1 x AsyncRAT, 1 x Formbook)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/344887/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.48217.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.21392.5516.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/639443149a505ad9423eab28/reports/daa8ed7d-b0b2-47d6-bdc7-330a62f8407b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f4bd9301-15c7-415d-99cc-db7e485d0486
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1131828
Signature
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-12-10 08:28:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wz2wso43js2yyzg7owqjndy2ynwi2vej2pe66snd2vcc6lq7gtha._file
Verdict:
malicious
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221210-kczytshh7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b6792088-2776-4585-a107-51cef134727f
Unpacked files
SH256 hash:
48cfbd8596ab011185ef7f65e86a51adc9c6d8d65ce2489d447c996b9307198c
MD5 hash:
a51da2ae1c153f71185ab8bc84fc72cd
SHA1 hash:
d0ed23cb6a2814f6ca5bba6b502d7bc2adb446b0
Link:
https://www.unpac.me/results/1db199ba-971c-4384-84bb-4b99797444ad/
SH256 hash:
67831417a9445ecc579ac1802f76cfe1a1c813f663ddbdbc7c21926a2210d9d0
MD5 hash:
82d7a0830f7941903acd1df67ae10280
SHA1 hash:
906947993281a8ae16285d4f2dc2f52dab024d07
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/1db199ba-971c-4384-84bb-4b99797444ad/
Parent samples :
b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce
b5976eb47b7ee86e14820c9ec28dfda460cefbcbcf9936c711512b9fd5260c10
ac74957ffebda2f33603be3668eab0eaeb0deb26874cc2f6f877ef0e2c85cd79
f149ad4d9fc4f3d0dc4cba5a0d1419ad81dc0fd37b179c5bff458ea3666a4c6c
062d1412e5065ad96e3bedcc9a721caf0b2744dde92edd16820c66b8f8679856
725a65de7a17d632eb35dc3e80e1464b1f279218d765cea8f4502c51b6798874
83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db
4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc
eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116
811776b7e88a6f52c43527f71c90981244e6cde742fe45a88c50b15327f5406b
fac6a7623bd40a11274201b5ea609d276e8fd43d82eff03e3136997dbe54c19e
SH256 hash:
922915132a628d0050bf03a473370544dde3323627fb4adcba3f1ba869537e50
MD5 hash:
1ecb63625d636b0b8f8ebdece9fa80c3
SHA1 hash:
5623d5ad21fc63893011bae7e4709c51219fcc1c
Link:
https://www.unpac.me/results/1db199ba-971c-4384-84bb-4b99797444ad/
SH256 hash:
79425c8325ebb6e80af187febe3db1c3550c8fa33b9a13b80ebb467839a677f6
MD5 hash:
bb2e24afdb91a222b114e53c5fe49455
SHA1 hash:
4f591fd6e91152a79aa75d2c5ccc5e5350692ccd
Link:
https://www.unpac.me/results/1db199ba-971c-4384-84bb-4b99797444ad/
SH256 hash:
a000e28f51f40830d58c277f38b69a9621cd261df82876289ea6e3080ff76928
MD5 hash:
9dbcdd52743d0ccf5ac7223d758a3fc7
SHA1 hash:
01ab24d6591d5d866d179951c39be031ed951508
Link:
https://www.unpac.me/results/1db199ba-971c-4384-84bb-4b99797444ad/
SH256 hash:
b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce
MD5 hash:
cd6076d8675c857ae061c0731c45566b
SHA1 hash:
78063654eccb02bfccc5f327eb2ab134c8d2d6a5
Link:
https://www.unpac.me/results/1db199ba-971c-4384-84bb-4b99797444ad/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/344887/

Comments