MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825
SHA3-384 hash: c688f377b06a2a5824d61782c1bd7b5eaaac6e1667b582d6b9224c40a88a76e56e64b232b51052b41545ce1b72660d1e
SHA1 hash: 6c6de2a714bf8f373d2c1ab8c8b8a6fb0ef065eb
MD5 hash: 4b576c400068d0d8158d03b2cdc15f4f
humanhash: illinois-west-north-nineteen
File name:AE2207003 INVOICE Pending payment.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:875'008 bytes
First seen:2022-07-11 08:09:23 UTC
Last seen:2022-07-12 06:18:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:JR05WSuGZzPZ7+q6VoFNmVbQc3C+WK+eriBLdD/DCOxArtvygo2YsA:jQcAbwq6VoLmZxCqriBLd3CnrtygrYs
Threatray 4'289 similar samples on MalwareBazaar
TLSH T1E615F1CAE154DA90E12A153C35BEE3D051B0AC7AC9DC7DCEB962703D4AF0977241B6CA
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f0ccf096c8f2ccf0 (15 x AgentTesla, 7 x Formbook, 5 x Loki)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
4
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
AE2207003 INVOICE Pending payment.exe
Verdict:
Malicious activity
Analysis date:
2022-07-11 22:45:14 UTC
Tags:
evasion trojan snake
Link:
https://app.any.run/tasks/f0829a52-5c71-435a-9460-44541b5b3d08

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/286013/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.28751.8040.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62cbdb17bbcf6baf2792f9ed/reports/93d9948e-073a-4ad6-b138-e310d825ed45/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/14f77cb0-c977-41a2-83f1-38d6cf7cc32a
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1029021
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 08:10:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y5zf3lhxm5446kacudomenmyzpa5l5oxuhnnscr7xlp2lpzb3asq._file
Verdict:
malicious
Similar samples:
04901f5238094d47c17a1edbf3b945bf68c8dc9d9e2f5b1b7d24eac54812e063
SnakeKeylogger
0fb0c020b97c509f0fed313a5653343cc0a9f5ebef8bc9c26335345e78f118db
SnakeKeylogger
1f1f5270f5864c63aa06f6d5265fee4f979e43144aa936d55c88f9f8c97840a8
SnakeKeylogger
4e4937d04ce933221fad993e7db49a096f11cefbe11c593da9041d5e375d6119
SnakeKeylogger
b9527b57b9fbb1b67da0530770e98dc15300f800c1cccd52c63de55692d693ee
SnakeKeylogger
c439e1f935661386e7fae6bb2716af4db1ad9d44cd874d40d22483292d2f6b5c
SnakeKeylogger
+ 4'279 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220711-j2pcyshfg5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
7fd3e05139c0747abe50c71744c7d477a449510b438427581b001f8eaecf5c78
MD5 hash:
ac120561b47e3d30abf0aea23bcbf68c
SHA1 hash:
d45175d054080df57b782676df141967d5303db5
Link:
https://www.unpac.me/results/5d53c78a-3cae-4f59-a4ef-f96c014a75ea/
SH256 hash:
0fae1855c65d635d55e5f6aa450d8c9f3bd63c5cb4ef8e7d6947757b6c4a812e
MD5 hash:
51b3e4f94acfd5f6febdeda4f4e09db3
SHA1 hash:
c526c72601e747287c80aebb4357e6091aa2a960
Link:
https://www.unpac.me/results/5d53c78a-3cae-4f59-a4ef-f96c014a75ea/
SH256 hash:
883b63ef84c6b1cc09687962beca56e4f4b7960df7c5459e29998befaa3ccf15
MD5 hash:
ecb3f27eb8279c51608c8ea8f8050655
SHA1 hash:
82385d75444ab5fccacf37e2746c7dce73faa7f3
Link:
https://www.unpac.me/results/5d53c78a-3cae-4f59-a4ef-f96c014a75ea/
SH256 hash:
615b3971e963b21d62a5650df87ef296e7772d2a1ce82d218c9cf5b682d6f58f
MD5 hash:
4c4aa3d5c5f8adb5434872040b06d41d
SHA1 hash:
56120df9e51bccdbc2b397be3da604b18c8da9fa
Link:
https://www.unpac.me/results/5d53c78a-3cae-4f59-a4ef-f96c014a75ea/
SH256 hash:
df0845c72f3c190e5dd84e367e6866bf88ec3c78cfbd04b41607fa4a6219f79f
MD5 hash:
cff4f51a1aa88ecc3bb43daac0500b3c
SHA1 hash:
17caad9561df9e4e754989483f516acf4e6be15c
Link:
https://www.unpac.me/results/5d53c78a-3cae-4f59-a4ef-f96c014a75ea/
SH256 hash:
c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825
MD5 hash:
4b576c400068d0d8158d03b2cdc15f4f
SHA1 hash:
6c6de2a714bf8f373d2c1ab8c8b8a6fb0ef065eb
Link:
https://www.unpac.me/results/5d53c78a-3cae-4f59-a4ef-f96c014a75ea/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar c826fb41bb3b7945a1f6d9d3562025fc294a9ddfc90f2cbabef245a491bb1267

SnakeKeylogger

Executable exe c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/286013/
  
Dropped by
SHA256 c826fb41bb3b7945a1f6d9d3562025fc294a9ddfc90f2cbabef245a491bb1267
  
Dropped by
MD5 90e9189e8cfacb33b390378b7b21be36
  
Dropped by
SHA256 355c5863b8fa6110ce14b757584a4541ec1ec39574cf0aade1544dead460d275
  
Dropped by
MD5 5243faffb593048186bf8e0a60073e86

Comments