MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bf313b3f5ba3c607ff160d216623797b06ce270ea0555c6cf85b52210d448b85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 11
| SHA256 hash: | bf313b3f5ba3c607ff160d216623797b06ce270ea0555c6cf85b52210d448b85 |
|---|---|
| SHA3-384 hash: | 2fb9c5743f1c478a22c9e10bf52ed0672949f85df8467825dd36a9d7d6bfe717cfaec496d61516783dd3edc39b709de9 |
| SHA1 hash: | c61af853bc233528c047b27f7d76ba3241082766 |
| MD5 hash: | 9aacc4cad4ee63514106dec64f72dd2d |
| humanhash: | princess-mango-ceiling-nebraska |
| File name: | RE SATIN ALMA EMRİ.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 958'464 bytes |
| First seen: | 2022-05-24 12:52:29 UTC |
| Last seen: | 2022-05-24 13:48:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:Ad3J7CSDX5Gqejwzz1KMxI3bAaFG8FgK7yt3CEHBaMMZh5W+RT:AD7drQq8wz0RUas8Fh7y8EZME+R |
| Threatray | 4'321 similar samples on MalwareBazaar |
| TLSH | T1AD155CD1F190CC97D96B05F2ED6BA43012E3AE9D95A4C10D2A99771B26B3352209FF0F |
| TrID | 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
310
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RE SATIN ALMA EMRİ.exe
Verdict:
Suspicious activity
Analysis date:
2022-05-25 02:50:11 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control.exe obfuscated packed replace.exe update.exe
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Status:
Malicious
First seen:
2022-05-24 12:53:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 4'311 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
a19918d7148ef5b6a0781192cacb95a43db9dac77f9aa3e117870dec272beaa5
MD5 hash:
9abe14bd88593e6826ee7f8aae71edcc
SHA1 hash:
a435a6436371889cc6122934d29936231a9621ac
SH256 hash:
e3fc6a708502cc60713cc01a0525a19b5c1bed06021e7b2549feb9999c76c56b
MD5 hash:
98a5208ffaa5f0dfe69f7a43f9e46367
SHA1 hash:
89f26f3b4334d3cc08b6667b3b1ff4c7a43ff354
SH256 hash:
ffd2621d5c3644aac93b1719710bde0cb8ed758dc8ce76fe5075654a565a6cb4
MD5 hash:
6a7ff5becbc4a4036c98b13b3ce09200
SHA1 hash:
7d7717cb284cc88036ce3e1ceb228f87d71835d8
SH256 hash:
dc1172cffc1869465b685cd51feb19839c86e2a73a95dfd56bcdfe744505f520
MD5 hash:
9c4b15703e036a63bc459e89950efdd5
SHA1 hash:
46c584c41f37c362add336651d293b532cb5715d
SH256 hash:
53ca3f09e79812173e7c44693da9e9266e739ddf5d523a321f491d24c186c7ea
MD5 hash:
0fc1fe35176605c4b12064fc6c2a9211
SHA1 hash:
4259440243232768b56cdfbf2207549bb6f0e647
SH256 hash:
bf313b3f5ba3c607ff160d216623797b06ce270ea0555c6cf85b52210d448b85
MD5 hash:
9aacc4cad4ee63514106dec64f72dd2d
SHA1 hash:
c61af853bc233528c047b27f7d76ba3241082766
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.