MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c15fd959d72ff5dd978a6e8e15877b3f41fba6a89d9bb4890287668b17d05a3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c15fd959d72ff5dd978a6e8e15877b3f41fba6a89d9bb4890287668b17d05a3c
SHA3-384 hash: bd1d463e1ac6a600c20df52349c0918554161f4c92d5a6707e366690f2d78f24f89e0555546ef237e1e0260576525b96
SHA1 hash: 3883c0b282e011c7954ed61e11a948511eec686f
MD5 hash: 7602435d3ce856276d88c70ade365e94
humanhash: solar-comet-mobile-sixteen
File name:SHIPPING DOCUMENT.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:22'080 bytes
First seen:2021-02-26 06:53:26 UTC
Last seen:2021-02-26 08:54:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 384:Re0rGud3kBBV9ERm5vZNd4Tcgs9Zuq0E5X7hPXf:Mjud3kBBbERgxNj9j5rhPXf
Threatray 16 similar samples on MalwareBazaar
TLSH 70A25A175FA7090ED8DBCA3C25E3890EEA307381D165C55B25DCB100DADFB892A2DE79
Reporter abuse_ch
Tags:DHL exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dhl.com
Sending IP: 77.247.110.185
From: DHL Customer Support <support@dhl.com>
Subject: Shipping Documents / Original BL, Invoice & Packing List
Attachment: SHIPPING DOCUMENT.IMG (contains "SHIPPING DOCUMENT.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SHIPPING DOCUMENT.exe
Verdict:
Malicious activity
Analysis date:
2021-02-26 07:04:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/89ec8888-6d3a-4fa0-8ca9-83307cba047d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/119346/
Detection(s):
SecuriteInfo.com.Artemis7602435D3CE8.21596.30967.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Launching a process
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a window
Running batch commands
Creating a file
Setting a single autorun event
Sending an HTTP GET request to an infection source
Adding exclusions to Windows Defender
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/619452
Signature
Adds a directory exclusion to Windows Defender
Binary contains a suspicious time stamp
Contains functionality to hide a thread from the debugger
Creates an autostart registry key pointing to binary in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Executable has a suspicious name (potential lure to open the executable)
Found malware configuration
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 358720 Sample: SHIPPING DOCUMENT.exe Startdate: 26/02/2021 Architecture: WINDOWS Score: 100 39 coroloboxorozor.com 2->39 49 Multi AV Scanner detection for domain / URL 2->49 51 Found malware configuration 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 10 other signatures 2->55 8 SHIPPING DOCUMENT.exe 17 7 2->8         started        13 explorer.exe 2->13         started        15 svchost.exe 9 1 2->15         started        17 7 other processes 2->17 signatures3 process4 dnsIp5 45 coroloboxorozor.com 104.21.71.230, 49719, 80 CLOUDFLARENETUS United States 8->45 33 C:\Windows\Microsoft.NET\...\svchost.exe, PE32 8->33 dropped 35 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 8->35 dropped 37 C:\Users\user\...\SHIPPING DOCUMENT.exe.log, ASCII 8->37 dropped 61 Creates an autostart registry key pointing to binary in C:\Windows 8->61 63 Adds a directory exclusion to Windows Defender 8->63 65 Hides threads from debuggers 8->65 19 cmd.exe 1 8->19         started        21 powershell.exe 9 8->21         started        67 Drops executables to the windows directory (C:\Windows) and starts them 13->67 23 svchost.exe 14 2 13->23         started        47 127.0.0.1 unknown unknown 15->47 file6 signatures7 process8 dnsIp9 27 conhost.exe 19->27         started        29 timeout.exe 1 19->29         started        31 conhost.exe 21->31         started        41 172.67.172.17, 49755, 49756, 80 CLOUDFLARENETUS United States 23->41 43 coroloboxorozor.com 23->43 57 System process connects to network (likely due to code injection or exploit) 23->57 59 Multi AV Scanner detection for dropped file 23->59 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c15fd959d72ff5dd978a6e8e15877b3f41fba6a89d9bb4890287668b17d05a3c/
Threat name:
ByteCode-MSIL.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 06:54:09 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yfp5swoxf7253f4kn2hblb33h5a7xjvitwn3jcicq5tiwf6qli6a._file
Verdict:
unknown
Similar samples:
5b60eef7b62c70f68311f80199578144694445d28286c7c87e7f79ace2875580
SnakeKeylogger
6c7624c020bb11d5803286dc0fc1d9ee44d21be97207573051bcd322091a731b
SnakeKeylogger
6e522cba657cf758c4443cdb216d7755a1ebf509b36b6a0e78ec183ac6aa7b72
SnakeKeylogger
80d3f66ba9b603c7f90d3303718763b736e8cfa76f676ff4a57db67b96610dc6
SnakeKeylogger
98bba6280dc438b35e3d0a4f468d1e50dd44bdafdd3e8c396a6dacf6be50fd71
SnakeKeylogger
b903be7c680d5eb78f951c7e1743b53e0cdfae05e19fa6fe7e77c84c29df1156
SnakeKeylogger
bcfcc5a278671fbe1b5f5f27c6d61921add83e57a0c61f80a165455b3fe0875a
SnakeKeylogger
e6628a7533fc340c5a6c659ecaba8a7626bc853c96d6e3571427aaaf124edde1
SnakeKeylogger
f4dcdf575d7c25bdba3e73ac2ff890b1103dcf43325b8876c5215204fcf7d1fb
SnakeKeylogger
fccc2c9b4b7755630827b24eb96f2dd1f989e43c86a8f218e6709a98160112f1
SnakeKeylogger
+ 6 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/210226-nswvatv7ls/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Windows security modification
Windows security bypass
Unpacked files
SH256 hash:
c15fd959d72ff5dd978a6e8e15877b3f41fba6a89d9bb4890287668b17d05a3c
MD5 hash:
7602435d3ce856276d88c70ade365e94
SHA1 hash:
3883c0b282e011c7954ed61e11a948511eec686f
Link:
https://www.unpac.me/results/26275459-ae26-4c0c-8683-e2894be82430/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 015fe149e66c36090ce8d6c09164cf54e3af17e9e8caf47122222916f04d6765

SnakeKeylogger

Executable exe c15fd959d72ff5dd978a6e8e15877b3f41fba6a89d9bb4890287668b17d05a3c

(this sample)

  
Dropped by
MD5 797710137b50ec55ad2d33018301dff8
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/119346/
  
Dropped by
SHA256 015fe149e66c36090ce8d6c09164cf54e3af17e9e8caf47122222916f04d6765

Comments