MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
SHA3-384 hash: cf80fd79b653ccc58ce1453ff10660afc12bc10cce5ba7025dcb3eaab1c06cbeddb2367b0c6e85b02a69bb4a84ceb081
SHA1 hash: a0256f4b6c8ca83d7be9449a51ebd76dd752c4b0
MD5 hash: e4a2682a7fa9db84cec9f798853975ab
humanhash: hawaii-coffee-lithium-nevada
File name:b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:742'912 bytes
First seen:2023-07-06 14:03:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'598 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:KmOlVKI6coWDpqY6NmN4u/yC8FWwTJ/8Oa+1nI1X6VEGEXqXdV:POvKInoWDcY60NDDCWqJa+xsS4qXdV
Threatray 3'399 similar samples on MalwareBazaar
TLSH T1C5F4024496E98717D9FB53F8A56195304BB2B85A6536E34E0E83F0DA2A33F108F01F27
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
280
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
Verdict:
Malicious activity
Analysis date:
2023-07-06 14:04:21 UTC
Tags:
snake evasion keylogger trojan
Link:
https://app.any.run/tasks/c5d226ca-a349-45ca-90e4-7eb6be6b02ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/409624/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67516941.13515.4341.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker comodo darkkomet packed
Link:
https://www.filescan.io/uploads/64a6c9d4784d6094d919e705/reports/7c93d4f3-da23-4001-b8f7-a0c8efca58c8/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e3717b99-8fa0-4ca7-ab74-ed071673cb42
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1268312
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1268312 Sample: TmJVj0ocq8.exe Startdate: 06/07/2023 Architecture: WINDOWS Score: 100 55 Found malware configuration 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 Sigma detected: Scheduled temp file as task from temp location 2->59 61 6 other signatures 2->61 7 TmJVj0ocq8.exe 7 2->7         started        11 cWXhNyYZCEvL.exe 4 2->11         started        process3 file4 37 C:\Users\user\AppData\...\cWXhNyYZCEvL.exe, PE32 7->37 dropped 39 C:\Users\...\cWXhNyYZCEvL.exe:Zone.Identifier, ASCII 7->39 dropped 41 C:\Users\user\AppData\Local\...\tmp71BC.tmp, XML 7->41 dropped 43 C:\Users\user\AppData\...\TmJVj0ocq8.exe.log, ASCII 7->43 dropped 63 May check the online IP address of the machine 7->63 65 Uses schtasks.exe or at.exe to add and modify task schedules 7->65 67 Adds a directory exclusion to Windows Defender 7->67 13 TmJVj0ocq8.exe 15 2 7->13         started        17 powershell.exe 21 7->17         started        19 powershell.exe 21 7->19         started        21 schtasks.exe 1 7->21         started        69 Multi AV Scanner detection for dropped file 11->69 71 Machine Learning detection for dropped file 11->71 73 Injects a PE file into a foreign processes 11->73 23 cWXhNyYZCEvL.exe 11->23         started        25 schtasks.exe 11->25         started        27 cWXhNyYZCEvL.exe 11->27         started        signatures5 process6 dnsIp7 45 checkip.dyndns.org 13->45 47 checkip.dyndns.com 158.101.44.242, 49707, 80 ORACLE-BMC-31898US United States 13->47 49 192.168.2.1 unknown unknown 13->49 29 conhost.exe 17->29         started        31 conhost.exe 19->31         started        33 conhost.exe 21->33         started        51 checkip.dyndns.org 23->51 53 132.226.8.169, 49708, 80 UTMEMUS United States 23->53 75 Tries to steal Mail credentials (via file / registry access) 23->75 77 Tries to harvest and steal browser information (history, passwords, etc) 23->77 35 conhost.exe 25->35         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-14 06:57:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w57e4aoxsclq2sjtpggagyrg57u5dygk3hqsy7pbm6ogk5a735iq._file
Verdict:
malicious
Similar samples:
051a0bbef441c7b7201d75212fe5bc6a71f051f95397adf1f401634b451151c5
SnakeKeylogger
07cfa4984b99d3fb354c156fb7db24103897c28a7486aaa34ccfcd255a8ee153
SnakeKeylogger
11e254d19638d13b5ca7387839d1b9e81b6722ff046f26d73388352d129b6322
SnakeKeylogger
35a10de4741e23670aadd4aa19babf2ab5b8f134c0df0050eaf2255b6d90c053
SnakeKeylogger
61e078d216229dec7f1fc09d3e3276167dde775b252bead7a5e28622a68a8d68
SnakeKeylogger
7e1aa5a27b397de94ebb0593c2a4aa59d90c0179539ec982c93848ff6470b9c0
SnakeKeylogger
99002f0c1304f392fb93c48abc83bcbe88c42854c06ebebc77617912747b7f1d
SnakeKeylogger
cfc611e16796060c1e801b318b09287414c7a01e3854f8a546aa5b58145e53a4
SnakeKeylogger
e2a4e3661a1ba5c88dbfcb792f0d489b37f14f74f2d1b2111a278bc81fb930c7
SnakeKeylogger
e9703790c616ac9dd9bc823da2867d5df41dcb51c1c82bd83d521d8feea5e8f6
SnakeKeylogger
+ 3'389 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230706-rc9atsca24/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6178167079:AAF89EAU6cjADoO39gVxivh4p16vKLDEJ0g/sendMessage?chat_id=2015447474
Unpacked files
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
a8558509d3653e4f86bf81fae67119f34231eaa6f3f6f63bf6e342848ed9382d
MD5 hash:
b8c03d09b52af782bf06fd3fc2d05826
SHA1 hash:
c878fae1d95881526c140a9b84c4adf934906b67
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
Parent samples :
6402781254bfa77827a02ef77d702ea6ccf0f3f0e01a6fada69105ce23b931e4
b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
94bcfa2f30dbe9c0f930ad54feb009eadc10f1f06cd5cba3b068fef35982f8da
9cd50229927cb6cc9e06d0884ab53ee5da6b8764fe60e326bbed779ddc5c8e2a
SH256 hash:
a819d3b78c7800a97d94d9d31b8a9f5db15a06945a828b122e3308259cdae85f
MD5 hash:
7f8b3f5559405c0d14fd534a0936baac
SHA1 hash:
c40c634a54c0db3c8909b2f998b0ddace32a07e4
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
bf3fc608dbe29b81e0cf3e13daa35ab147f7ddd9ea102a911a4a9da9f492ab7a
MD5 hash:
0704ca9d245677dfd28a12a064798808
SHA1 hash:
b21e761cee508020b8a7df43af78a85bea331ebd
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
d6d27ed1939b8527bfaab77b5cda589e3cdc842639958f7b4b63aed35ac7a7ab
MD5 hash:
72b601a1609673f221ca537200e6f074
SHA1 hash:
9bd391169223d5d967cbda11e237b68204cb8511
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
a8558509d3653e4f86bf81fae67119f34231eaa6f3f6f63bf6e342848ed9382d
MD5 hash:
b8c03d09b52af782bf06fd3fc2d05826
SHA1 hash:
c878fae1d95881526c140a9b84c4adf934906b67
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
Parent samples :
6402781254bfa77827a02ef77d702ea6ccf0f3f0e01a6fada69105ce23b931e4
b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
94bcfa2f30dbe9c0f930ad54feb009eadc10f1f06cd5cba3b068fef35982f8da
9cd50229927cb6cc9e06d0884ab53ee5da6b8764fe60e326bbed779ddc5c8e2a
SH256 hash:
a819d3b78c7800a97d94d9d31b8a9f5db15a06945a828b122e3308259cdae85f
MD5 hash:
7f8b3f5559405c0d14fd534a0936baac
SHA1 hash:
c40c634a54c0db3c8909b2f998b0ddace32a07e4
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
bf3fc608dbe29b81e0cf3e13daa35ab147f7ddd9ea102a911a4a9da9f492ab7a
MD5 hash:
0704ca9d245677dfd28a12a064798808
SHA1 hash:
b21e761cee508020b8a7df43af78a85bea331ebd
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
d6d27ed1939b8527bfaab77b5cda589e3cdc842639958f7b4b63aed35ac7a7ab
MD5 hash:
72b601a1609673f221ca537200e6f074
SHA1 hash:
9bd391169223d5d967cbda11e237b68204cb8511
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
a8558509d3653e4f86bf81fae67119f34231eaa6f3f6f63bf6e342848ed9382d
MD5 hash:
b8c03d09b52af782bf06fd3fc2d05826
SHA1 hash:
c878fae1d95881526c140a9b84c4adf934906b67
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
Parent samples :
6402781254bfa77827a02ef77d702ea6ccf0f3f0e01a6fada69105ce23b931e4
b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
94bcfa2f30dbe9c0f930ad54feb009eadc10f1f06cd5cba3b068fef35982f8da
9cd50229927cb6cc9e06d0884ab53ee5da6b8764fe60e326bbed779ddc5c8e2a
SH256 hash:
a819d3b78c7800a97d94d9d31b8a9f5db15a06945a828b122e3308259cdae85f
MD5 hash:
7f8b3f5559405c0d14fd534a0936baac
SHA1 hash:
c40c634a54c0db3c8909b2f998b0ddace32a07e4
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
bf3fc608dbe29b81e0cf3e13daa35ab147f7ddd9ea102a911a4a9da9f492ab7a
MD5 hash:
0704ca9d245677dfd28a12a064798808
SHA1 hash:
b21e761cee508020b8a7df43af78a85bea331ebd
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
d6d27ed1939b8527bfaab77b5cda589e3cdc842639958f7b4b63aed35ac7a7ab
MD5 hash:
72b601a1609673f221ca537200e6f074
SHA1 hash:
9bd391169223d5d967cbda11e237b68204cb8511
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
a8558509d3653e4f86bf81fae67119f34231eaa6f3f6f63bf6e342848ed9382d
MD5 hash:
b8c03d09b52af782bf06fd3fc2d05826
SHA1 hash:
c878fae1d95881526c140a9b84c4adf934906b67
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
Parent samples :
6402781254bfa77827a02ef77d702ea6ccf0f3f0e01a6fada69105ce23b931e4
b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
94bcfa2f30dbe9c0f930ad54feb009eadc10f1f06cd5cba3b068fef35982f8da
9cd50229927cb6cc9e06d0884ab53ee5da6b8764fe60e326bbed779ddc5c8e2a
SH256 hash:
a8558509d3653e4f86bf81fae67119f34231eaa6f3f6f63bf6e342848ed9382d
MD5 hash:
b8c03d09b52af782bf06fd3fc2d05826
SHA1 hash:
c878fae1d95881526c140a9b84c4adf934906b67
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
Parent samples :
6402781254bfa77827a02ef77d702ea6ccf0f3f0e01a6fada69105ce23b931e4
b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
94bcfa2f30dbe9c0f930ad54feb009eadc10f1f06cd5cba3b068fef35982f8da
9cd50229927cb6cc9e06d0884ab53ee5da6b8764fe60e326bbed779ddc5c8e2a
SH256 hash:
a819d3b78c7800a97d94d9d31b8a9f5db15a06945a828b122e3308259cdae85f
MD5 hash:
7f8b3f5559405c0d14fd534a0936baac
SHA1 hash:
c40c634a54c0db3c8909b2f998b0ddace32a07e4
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
bf3fc608dbe29b81e0cf3e13daa35ab147f7ddd9ea102a911a4a9da9f492ab7a
MD5 hash:
0704ca9d245677dfd28a12a064798808
SHA1 hash:
b21e761cee508020b8a7df43af78a85bea331ebd
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
a819d3b78c7800a97d94d9d31b8a9f5db15a06945a828b122e3308259cdae85f
MD5 hash:
7f8b3f5559405c0d14fd534a0936baac
SHA1 hash:
c40c634a54c0db3c8909b2f998b0ddace32a07e4
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
d6d27ed1939b8527bfaab77b5cda589e3cdc842639958f7b4b63aed35ac7a7ab
MD5 hash:
72b601a1609673f221ca537200e6f074
SHA1 hash:
9bd391169223d5d967cbda11e237b68204cb8511
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
bf3fc608dbe29b81e0cf3e13daa35ab147f7ddd9ea102a911a4a9da9f492ab7a
MD5 hash:
0704ca9d245677dfd28a12a064798808
SHA1 hash:
b21e761cee508020b8a7df43af78a85bea331ebd
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
d6d27ed1939b8527bfaab77b5cda589e3cdc842639958f7b4b63aed35ac7a7ab
MD5 hash:
72b601a1609673f221ca537200e6f074
SHA1 hash:
9bd391169223d5d967cbda11e237b68204cb8511
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
SH256 hash:
b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51
MD5 hash:
e4a2682a7fa9db84cec9f798853975ab
SHA1 hash:
a0256f4b6c8ca83d7be9449a51ebd76dd752c4b0
Link:
https://www.unpac.me/results/2061e6d3-a589-4c81-8db1-6010f4cab690/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/409624/

Comments