MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15
SHA3-384 hash: 0b817e6b98a1311a1338c1903f942a049e7a543a72d5fa80d73c30904e7f8146f6b3c2b80896e191e2ae6c662edcd9c0
SHA1 hash: 1033a94c129f60d5ef3915f0f8f1a9882eb4c845
MD5 hash: 7e439c7f9636682598cb3438da45ebe9
humanhash: dakota-cup-video-fillet
File name:7e439c7f9636682598cb3438da45ebe9
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:388'096 bytes
First seen:2022-05-16 05:31:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:BaFn8icad8KTKX6YcdxqS/4ra4BC6F2eqGqoiVmHf8M2GQAXObT4:f6NgoDqS/FX6FXqa/87G/X7
Threatray 3'910 similar samples on MalwareBazaar
TLSH T1AD84CFAE9755C509D8A93A7B88F363307F01BE2011B3D39F60D5788B95B7BE63C90290
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon ecf0c68ac2c298f2 (60 x SnakeKeylogger, 14 x Formbook, 6 x AgentTesla)
Reporter zbetcheckin
Tags:32 exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7e439c7f9636682598cb3438da45ebe9
Verdict:
Malicious activity
Analysis date:
2022-05-16 07:59:19 UTC
Tags:
evasion trojan snake keylogger
Link:
https://app.any.run/tasks/db59bf8d-9b99-4c44-a017-183e793b0ad7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/270883/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6281e1a722b733139c1f57f4/reports/e6bf27f7-b8ee-437f-a875-a96c52412e9f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2325aece-6106-428e-8039-d62446f99a00
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/994578
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 627070 Sample: EQ3U04OPh6 Startdate: 16/05/2022 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 8 other signatures 2->54 8 EQ3U04OPh6.exe 2 2->8         started        process3 file4 42 C:\Users\user\AppData\...Q3U04OPh6.exe.log, ASCII 8->42 dropped 56 May check the online IP address of the machine 8->56 58 Writes to foreign memory regions 8->58 60 Injects a PE file into a foreign processes 8->60 12 EQ3U04OPh6.exe 8->12         started        16 cmd.exe 1 8->16         started        18 cmd.exe 1 8->18         started        20 18 other processes 8->20 signatures5 process6 dnsIp7 44 checkip.dyndns.com 193.122.6.168, 49748, 80 ORACLE-BMC-31898US United States 12->44 46 checkip.dyndns.org 12->46 62 Tries to steal Mail credentials (via file / registry access) 12->62 64 Tries to harvest and steal ftp login credentials 12->64 66 Tries to harvest and steal browser information (history, passwords, etc) 12->66 22 timeout.exe 1 16->22         started        24 conhost.exe 16->24         started        26 conhost.exe 18->26         started        28 timeout.exe 1 18->28         started        30 conhost.exe 20->30         started        32 conhost.exe 20->32         started        34 conhost.exe 20->34         started        36 31 other processes 20->36 signatures8 process9 process10 38 conhost.exe 22->38         started        40 timeout.exe 22->40         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-05-16 05:32:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
17 of 26 (65.38%)
Threat level:
  3/5
Verdict:
malicious
Similar samples:
119e4387c730d77226134d71e01db6a53f4eebbda8aeebf0ce9120003237b241
SnakeKeylogger
2b317db474aaa5798fa907d94e7d1cd8a284386c988c924c9f5dd156f21ebc54
SnakeKeylogger
2bfea17922f05369c64106054d491ed82119003d0e23061bd6b4c8a76c07f6b9
SnakeKeylogger
7501983c1a978a1a77485daf4811f9bebe31c18f28d95d456402b27860289c1f
SnakeKeylogger
7905618d53c7c0d9b949044ac76a711aed6ab9a5b6e7156c08871637a2858666
SnakeKeylogger
a2740d771fd485b1010c57895ae92798ab9b7f06f9e21808c49dadd0557c64c4
SnakeKeylogger
b189ba60839a515b25f12ed2af1f67f2874806e23611ee8d12584d07db10b4b9
SnakeKeylogger
e54702edca66649a4e9f2d9af065fedc078257bad7ece8952fbff60f7b9fc87f
SnakeKeylogger
fec889ae8aee9a919471ea23e1603d9f76be40fb90b9298a8e7c607263acdd1b
SnakeKeylogger
+ 3'900 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220516-f79z3ahecq/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
b178d3114ce2ecac8e2aca2d119811db7f86339bb2c6af05d7b7c6a1a44041d4
MD5 hash:
35d1db327e6849d67e99accfc895eec1
SHA1 hash:
649ff0f8ea2a84ca86e3242f88e75352f3993661
Link:
https://www.unpac.me/results/505591c9-27fd-47f2-ad63-9be545f92616/
SH256 hash:
f9c12e669bf98427ec57016c39d1fe310c8fe618f0c027377a729d9722602764
MD5 hash:
adefd1cf5a28d447dacfa5d369f307b1
SHA1 hash:
da5d1328d56feb7312b07f9f3e3717063dbcce86
Link:
https://www.unpac.me/results/505591c9-27fd-47f2-ad63-9be545f92616/
SH256 hash:
9f01d9f2ed07e630ec078efa5d760762c3c8ad3b06e9e8a9062a37d63d57b026
MD5 hash:
9fbb8cec55b2115c00c0ba386c37ce62
SHA1 hash:
e2378a1c22c35e40fd1c3e19066de4e33b50f24a
Link:
https://www.unpac.me/results/505591c9-27fd-47f2-ad63-9be545f92616/
SH256 hash:
b8d66205770267f28db3e3c1b6de41559a47c0c0d61d9acf89c94c732b92ae93
MD5 hash:
edd5d7e0431d41f9a1574e1c677944f7
SHA1 hash:
e619d415e85c4555d0c370d3de374bbc68e7a00b
Link:
https://www.unpac.me/results/505591c9-27fd-47f2-ad63-9be545f92616/
SH256 hash:
bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15
MD5 hash:
7e439c7f9636682598cb3438da45ebe9
SHA1 hash:
1033a94c129f60d5ef3915f0f8f1a9882eb4c845
Link:
https://www.unpac.me/results/505591c9-27fd-47f2-ad63-9be545f92616/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bfc94f0bd631/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Reverse_DOS_header
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects an reversed DOS header
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2196837/
Cape
Cape
https://www.capesandbox.com/analysis/270883/

Comments


Avatar
zbet commented on 2022-05-16 05:31:10 UTC

url : hxxp://62.197.136.176/files/filezx.exe