MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b85cd5adf481181d46df9cee2dcde6db46ed4d27e143f201a093d06e32587d06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments 1

SHA256 hash:	b85cd5adf481181d46df9cee2dcde6db46ed4d27e143f201a093d06e32587d06
SHA3-384 hash:	b038b8d3d6df91efd3d3d4d3d81bd21f6315bb0a3f07089efea6a21eba06a5d3ff54948aea958d4636d9e8c0a48e20e4
SHA1 hash:	0432f474d57d8684b88c003e73ff10796458c253
MD5 hash:	7581a5c867ffae96ede937125b13dad6
humanhash:	vermont-early-mockingbird-nineteen
File name:	clip_image001.rar
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	326'596 bytes
First seen:	2023-03-23 06:05:32 UTC
Last seen:	2023-03-23 06:06:24 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:Z+vG07R3PTf76/dF3JceV18TlKPdzvbkBTz4uyrTMNarvhVCyn+DFe:4R/TsFP18TlKP5bC4uyrTMNU5IyP
TLSH	T1F36423983D2064DF9CD351EB79CFC419E20BC91FA9AD919FE038A556F201B53DB104AE
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	rar SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: "joost@bluefingersupply.nl" (likely spoofed)
Received: "from virt2539.sormaiberica.es (virt2539.sormaiberica.es [31.200.244.30]) "
Date: "Thu, 23 Mar 2023 02:50:03 +0100"
Subject: "Business opportunities"
Attachment: "clip_image001.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	clip_image001.exe
File size:	420'886 bytes
SHA256 hash:	47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34
MD5 hash:	0600fd383dfdc1c13eec78c11c9a848d
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/b85cd5adf481181d46df9cee2dcde6db46ed4d27e143f201a093d06e32587d06/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

buer guloader overlay packed shell32.dll trickbot

Link:

https://www.filescan.io/uploads/641bec4cb236355850d78b43/reports/143aa353-9dde-4d19-9466-2940fc5921e9/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b85cd5adf481181d46df9cee2dcde6db46ed4d27e143f201a093d06e32587d06

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b85cd5adf481181d46df9cee2dcde6db46ed4d27e143f201a093d06e32587d06/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xbonllpuqemb2rw7ttxc3tpg3ndo2tjh4fb7eanaspig4msypuda._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection discovery keylogger stealer

Link:

https://tria.ge/reports/230323-gwjt6sdh94/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks QEMU agent file

Loads dropped DLL

Snake Keylogger

Snake Keylogger payload

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.