MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b77e3e84de86638c416552528b16e63b8ef6b0e2a9c51b311f40745bc04c9c96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b77e3e84de86638c416552528b16e63b8ef6b0e2a9c51b311f40745bc04c9c96
SHA3-384 hash: 80f2cc7ded6e781e04ca4f47d8b8aaf7a92c69c003131bd049a9bb8d7d6bbf0699f1da0697467b10860dc6b5e6d83b20
SHA1 hash: c10af2c2ecc5c55c440d73d2f45615fb70eb085e
MD5 hash: f29029da158160c99c803669eef3992f
humanhash: shade-indigo-juliet-winner
File name:Revised Invoice.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:856'576 bytes
First seen:2022-10-20 10:32:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:IaIMvqV2fEu20RBlLT6qFilGGLCcz731e++L7GRyePekE7Dgq+ZsWit5CWD:IaIZ0PwlllzLo/7kIf7cFzW
Threatray 3'000 similar samples on MalwareBazaar
TLSH T10E05F5B221D60697FA2636B58043D5B362FBAE412045D0C369D36FAFFC845BB9223357
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Revised Invoice.exe
Verdict:
Malicious activity
Analysis date:
2022-10-20 10:38:47 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/6e45141b-e1a2-4d2b-94e6-68374eb39fc9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/321964/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/635123e0898b0652a4b91b6b/reports/5741e10c-f73e-4147-98fb-2a88cf14cea9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fc19486c-0eb5-4f14-b3e5-5e84a7e27544
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1094086
Signature
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 726718 Sample: Revised Invoice.exe Startdate: 20/10/2022 Architecture: WINDOWS Score: 100 53 Snort IDS alert for network traffic 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Sigma detected: Scheduled temp file as task from temp location 2->57 59 12 other signatures 2->59 7 Revised Invoice.exe 7 2->7         started        11 hmEISTxCX.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\Roaming\hmEISTxCX.exe, PE32 7->35 dropped 37 C:\Users\...\hmEISTxCX.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmp509C.tmp, XML 7->39 dropped 41 C:\Users\user\...\Revised Invoice.exe.log, ASCII 7->41 dropped 61 Adds a directory exclusion to Windows Defender 7->61 63 Injects a PE file into a foreign processes 7->63 13 Revised Invoice.exe 15 2 7->13         started        17 powershell.exe 19 7->17         started        19 schtasks.exe 1 7->19         started        21 Revised Invoice.exe 7->21         started        65 Multi AV Scanner detection for dropped file 11->65 67 May check the online IP address of the machine 11->67 69 Machine Learning detection for dropped file 11->69 23 hmEISTxCX.exe 14 2 11->23         started        25 schtasks.exe 1 11->25         started        signatures5 process6 dnsIp7 43 checkip.dyndns.com 193.122.130.0, 49695, 80 ORACLE-BMC-31898US United States 13->43 45 checkip.dyndns.org 13->45 47 192.168.2.1 unknown unknown 13->47 71 Tries to steal Mail credentials (via file / registry access) 13->71 73 Tries to harvest and steal ftp login credentials 13->73 75 Tries to harvest and steal browser information (history, passwords, etc) 13->75 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        49 132.226.247.73, 49696, 80 UTMEMUS United States 23->49 51 checkip.dyndns.org 23->51 31 WerFault.exe 23->31         started        33 conhost.exe 25->33         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b77e3e84de86638c416552528b16e63b8ef6b0e2a9c51b311f40745bc04c9c96/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-10-20 07:43:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
21 of 26 (80.77%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w57d5bg6qzryyqlfkjjiwfxghohpnmhcvhcrwmi7ib2fxqcmtsla._file
Verdict:
malicious
Similar samples:
0f1b9c97ca2d11237543964ee3fd39734c0e9cc2371aed7dd49deb4409c839d2
SnakeKeylogger
206152e81698ba0e9c2ae22189a2502ed3a9eb6df79fbd67a830088445dbc723
SnakeKeylogger
392eeab0970120d5610a1707ecd9062d38f4ccb6946eec9d0c057fbc82e246fa
SnakeKeylogger
6da766510fe8768a10d22c5c2bb7e6362d65f6684de20e88f63d66e3be898ab2
SnakeKeylogger
757a2b679b265a2f5041b23b69748ca1786ca2703d4f2544e1c22a82d76cc91a
SnakeKeylogger
8a8e4af9303c7a1ed727e3dc8eac70802cfd184cccd4d678aa3d7a8473dff210
SnakeKeylogger
8f2472fe35fbf197d9bdf528f2e1fabfb12ca806b064d055253d719aa1fbad9b
SnakeKeylogger
b7899c0b3cb13fdc7531fa445e82d4f4a86d0691951b48bb55c529bab90b1719
SnakeKeylogger
d1002023bc21124f3d49a6b6e3e957ec6679031525cce7b4e698af3db9c2d418
SnakeKeylogger
f5513ad2ae4942ab753e178eefecfc0c62396c9a1a9128c2a65591780faad3ef
SnakeKeylogger
+ 2'990 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/221020-mlhr1shfgl/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/af47d62d-d3fe-4c82-a115-2e34928e5f03
Unpacked files
SH256 hash:
677b7bd068433477d0373a8d78b6769a843dfe3c84938e2fdf5b1354a11cf92d
MD5 hash:
dd5993cfc9bea814da11082c8ef0498c
SHA1 hash:
a6453fa4a34dc58cb4b29b438bb6dab0a4a892b0
Link:
https://www.unpac.me/results/284167c5-3faf-42fc-8408-c851ed460ff0/
SH256 hash:
caa8d91f362042090ef444ea91fe39fe709c38f2daa6bdd6b10342bee3f581ae
MD5 hash:
8f5a7d204363502711899b9015275e06
SHA1 hash:
9222c5cdf67b4afe4a1e15249a7263e5f6ebd11a
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/284167c5-3faf-42fc-8408-c851ed460ff0/
Parent samples :
213b9b73afda58d8da041be3fd5d5daba2808793f43162ab608a2e1f73b9f9c7
b77e3e84de86638c416552528b16e63b8ef6b0e2a9c51b311f40745bc04c9c96
54b0eb55154034c41a44541ea08ea61c61599dd98d1963c103de52d2d5c6bbc4
SH256 hash:
ec112c9ff65947cc1d8d4e05c178fb8a36b0227491315b708632d417b59e0540
MD5 hash:
9c15152b6c909d848a5199be600da837
SHA1 hash:
7db33454c7c9a831ea0467a0b20165c1323ae67b
Link:
https://www.unpac.me/results/284167c5-3faf-42fc-8408-c851ed460ff0/
SH256 hash:
70dfa4c873605ab0fcdcb62be2a970da110535280d8dc88261edbe1ed2865307
MD5 hash:
d5b0f8aff064b3e828421b48efccd312
SHA1 hash:
724f4bc7ab4e08c45562748b739c8f7496a5ad8f
Link:
https://www.unpac.me/results/284167c5-3faf-42fc-8408-c851ed460ff0/
SH256 hash:
678d527fc01a0eaa1be366ca97b0ad5a3fe890b1ef8267d2fc981ff43c4d08e5
MD5 hash:
2da433d67db4775d8f02a8fed4b31bf3
SHA1 hash:
235fe8f2076f3b5cfffacc574825550cee8e61e9
Link:
https://www.unpac.me/results/284167c5-3faf-42fc-8408-c851ed460ff0/
SH256 hash:
b77e3e84de86638c416552528b16e63b8ef6b0e2a9c51b311f40745bc04c9c96
MD5 hash:
f29029da158160c99c803669eef3992f
SHA1 hash:
c10af2c2ecc5c55c440d73d2f45615fb70eb085e
Link:
https://www.unpac.me/results/284167c5-3faf-42fc-8408-c851ed460ff0/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b77e3e84de86/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b77e3e84de86638c416552528b16e63b8ef6b0e2a9c51b311f40745bc04c9c96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe b77e3e84de86638c416552528b16e63b8ef6b0e2a9c51b311f40745bc04c9c96

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/321964/

Comments