🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9
SHA3-384 hash: 023200d7909316d7d54281e8b0b3c4542468fdcfd77c5795ff8daacb5d1ac1d1d6b9dd7627f206dd2ea034b75cca1a37
SHA1 hash: 7db6e4d3e5e2db1cd12717fa9a62a35a52834c02
MD5 hash: e708aa3160e224de971421d5bc2fee29
humanhash: yankee-charlie-asparagus-oranges
File name:Payment_Advice.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:957'952 bytes
First seen:2024-05-01 13:15:19 UTC
Last seen:2024-05-01 14:21:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'246 x AgentTesla, 20'509 x Formbook, 12'375 x SnakeKeylogger)
ssdeep 12288:zjU00pFjzc/AKi9r4atz4fM3F58HMiEJy54ll8zhc6O6vo6Oh8IPMbP:L0s3iN4atkA/8Rze78zbP
Threatray 5'815 similar samples on MalwareBazaar
TLSH T120156A593BE44657DDBA433F60EB49396BB9EC0A2213EB0F0381B57A3C13398D8515A7
TrID 35.4% (.EXE) Win64 Executable (generic) (10523/12/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon ee8292b2aa8e9ec9 (2 x SnakeKeylogger)
Reporter Anonymous
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
310
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9.exe
Verdict:
Malicious activity
Analysis date:
2024-05-01 13:19:01 UTC
Tags:
evasion snake keylogger
Link:
https://app.any.run/tasks/08284e83-75d3-4bdc-959c-eb5786abd7e8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BackDoor.Bladabindi.13678.25309.14752.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the Windows subdirectories
Searching for synchronization primitives
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm lolbin masquerade remote
Link:
https://www.filescan.io/uploads/663240959cdc03b57ab8ca28/reports/3d56d137-377b-4673-93c5-87328fc9e49f/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3c2fcd50-4b0b-47b0-b060-d117ad986c42
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1434636
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Drops PE files with a suspicious file extension
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1434636 Sample: Payment_Advice.exe Startdate: 01/05/2024 Architecture: WINDOWS Score: 100 51 mail.qoldenfrontier.com 2->51 53 checkip.dyndns.org 2->53 55 4 other IPs or domains 2->55 69 Snort IDS alert for network traffic 2->69 71 Multi AV Scanner detection for domain / URL 2->71 73 Found malware configuration 2->73 75 14 other signatures 2->75 12 Payment_Advice.exe 3 2->12         started        15 svchost.exe 2->15         started        signatures3 process4 dnsIp5 93 Injects a PE file into a foreign processes 12->93 18 Payment_Advice.exe 7 12->18         started        67 127.0.0.1 unknown unknown 15->67 signatures6 process7 file8 45 C:\Users\user\AppData\Local\Temp\...\9D55.vbs, data 18->45 dropped 21 wscript.exe 1 18->21         started        process9 signatures10 77 Suspicious powershell command line found 21->77 79 Wscript starts Powershell (via cmd or directly) 21->79 81 Bypasses PowerShell execution policy 21->81 83 2 other signatures 21->83 24 powershell.exe 17 19 21->24         started        process11 dnsIp12 63 advising-receipts.com 172.67.141.195, 443, 49704, 49705 CLOUDFLARENETUS United States 24->63 47 C:\Windows\Temp\hadvices.scr, PE32 24->47 dropped 49 C:\Users\Public\Payment_Advice.pdf, PDF 24->49 dropped 89 Drops PE files with a suspicious file extension 24->89 91 Powershell drops PE file 24->91 29 hadvices.scr 24->29         started        32 Acrobat.exe 20 75 24->32         started        34 conhost.exe 24->34         started        file13 signatures14 process15 signatures16 95 Multi AV Scanner detection for dropped file 29->95 97 Machine Learning detection for dropped file 29->97 99 Injects a PE file into a foreign processes 29->99 36 hadvices.scr 29->36         started        40 AcroCEF.exe 106 32->40         started        process17 dnsIp18 57 mail.qoldenfrontier.com 108.167.142.65, 49743, 49744, 49745 UNIFIEDLAYER-AS-1US United States 36->57 59 checkip.dyndns.com 193.122.130.0, 49720, 49728, 49730 ORACLE-BMC-31898US United States 36->59 61 2 other IPs or domains 36->61 85 Tries to steal Mail credentials (via file / registry access) 36->85 87 Tries to harvest and steal browser information (history, passwords, etc) 36->87 42 AcroCEF.exe 40->42         started        signatures19 process20 dnsIp21 65 23.56.12.145, 443, 49715 AKAMAI-ASUS United States 42->65
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-05-01 13:12:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xj4nn755dpkwiwmlgor5fdkdpm76oeu77oj552aoomxeicmltkuq._file
Verdict:
malicious
Similar samples:
3b30d701c4a16466458275c153de993a673df2ecd4691d6e664d934cfef1d56e
SnakeKeylogger
6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6
SnakeKeylogger
931ded16af5bdb188c63d5c77a5c332b809fda77cf7c6528202259342a23bf39
SnakeKeylogger
ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9
SnakeKeylogger
+ 5'805 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer upx
Link:
https://tria.ge/reports/240501-qhsplahg48/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
Blocklisted process makes network request
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://scratchdreams.tk
Unpacked files
SH256 hash:
310dee0c2c026e4c8677585906073ea72c364274f06c653eecfc58f13f6def27
MD5 hash:
917f5e9f7301eeb6b8f330e9afb9d9a3
SHA1 hash:
f66382cf7504286859c56f29e4dbba9d1f9d71f9
Link:
https://www.unpac.me/results/d53ec505-e14e-428f-a7b4-e6f8a21d03cd/
SH256 hash:
d749e5a14ff077a7941aa5510a3eb9e0fc510a942e656b9c7df0a5b30cf2e27d
MD5 hash:
8a8f5a44c3d05ccd237594c8eda0130f
SHA1 hash:
d0d60997e1e61853f3374146361d894aeb7a484e
Detections:
MALWARE_Win_DLInjector02
Create hunting rule
Link:
https://www.unpac.me/results/d53ec505-e14e-428f-a7b4-e6f8a21d03cd/
SH256 hash:
45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b
MD5 hash:
fb1bc19121c4e190d83672bc71b493f0
SHA1 hash:
c3488b969ba578e28ee360be24b6416425a224a0
Link:
https://www.unpac.me/results/d53ec505-e14e-428f-a7b4-e6f8a21d03cd/
SH256 hash:
ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9
MD5 hash:
e708aa3160e224de971421d5bc2fee29
SHA1 hash:
7db6e4d3e5e2db1cd12717fa9a62a35a52834c02
Link:
https://www.unpac.me/results/d53ec505-e14e-428f-a7b4-e6f8a21d03cd/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ba78d6ffbd1b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments