MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 11
| SHA256 hash: | b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60 |
|---|---|
| SHA3-384 hash: | 0cf790ac2120615011d75945ea2e0a8232e57e4ab315759c31d228ad8185acf2b739aa46db4b6ce08825fdd7f80406be |
| SHA1 hash: | c415ba40d88e682fc6aaf2932ab598b1c3f2aeb6 |
| MD5 hash: | 78015f9defe5b97192708769bd57afc3 |
| humanhash: | march-december-cold-mockingbird |
| File name: | Bank contract,PDF.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 641'024 bytes |
| First seen: | 2021-07-22 12:35:34 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:IOZO+PfYPZgR0qIl6ZGabya2a5uQShrg0+tg9syaUVKnp:IOZrYQFIUZGta5Yhcxg9zahp |
| Threatray | 330 similar samples on MalwareBazaar |
| TLSH | T18ED4D078631FA744DC3883FC2C69D05127FAA01DA61DDA793E9890BC7CB2AB856F0651 |
| Reporter |  malwarelabnet |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Bank contract,PDF.exe
Verdict:
Malicious activity
Analysis date:
2021-07-22 12:43:23 UTC
Tags:
evasion trojan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Detection(s):
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code references suspicious native API functions
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-07-22 02:50:55 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 320 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Malware Config
C2 Extraction:
https://api.telegram.org/bot1845238130:AAHi6gsFs5hUVM4gq6AZswKJ0BHdbnMgjsI/sendMessage?chat_id=Draww72Bot
Unpacked files
SH256 hash:
f6b23c2884fde5426c34fb8fa0b1985b41613197a85a080932126455752455d4
MD5 hash:
29a6b46d14c3bca3295dcedd96f37e98
SHA1 hash:
d68096b7d687f96fb5f65a2783cafa20de1ea9f3
SH256 hash:
2098d045a08e4bcfab0a2d612a6141baed25adb056f8dce6e6811d39a9f679b4
MD5 hash:
4209e414a9e2f31c5e1526cd0cc70324
SHA1 hash:
687f14c9980e0381c314ad3ae84bf2be8b6d8a0c
SH256 hash:
da9e04caf0b978441d0ce4179a9c6ff8bbc6738d80d1e4473f83b71945f7e023
MD5 hash:
1c1829993db5ebc8d744aa547baa9003
SHA1 hash:
5fa7ecd967b8e600a33ff71334db504ead12b447
SH256 hash:
83d9e44d9a311ea6fdbcbd09fdc816a2067806dcacf24beb5ee786191b1a3ea1
MD5 hash:
b1a7b752b6638ee03cffe5a1dde9213e
SHA1 hash:
52d215a173d2f293990f8c12fc7f4a86330a29cb
SH256 hash:
b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60
MD5 hash:
78015f9defe5b97192708769bd57afc3
SHA1 hash:
c415ba40d88e682fc6aaf2932ab598b1c3f2aeb6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.