MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c80241ea11e21a083fc390af690cc0e6b2ee1ef91df4aaed6c44b10a753a1230. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 16
| SHA256 hash: | c80241ea11e21a083fc390af690cc0e6b2ee1ef91df4aaed6c44b10a753a1230 |
|---|---|
| SHA3-384 hash: | 1cbb31b500ece309f8204215bc5ee60b60c8c91cf161f46db5a4f54e673fd348c9c5d34ea4a53ff93995c6b9041a17e9 |
| SHA1 hash: | 093fdb2c0c27a3529334ba633dbfa8d796777e61 |
| MD5 hash: | c1cb1b7d55e1e940b20e8e950c89691a |
| humanhash: | magnesium-magnesium-beryllium-zebra |
| File name: | siparis belge.pdf.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 1'075'200 bytes |
| First seen: | 2023-03-10 12:14:09 UTC |
| Last seen: | 2023-03-10 13:31:10 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:cFlLKHFjcsqUWpT80HmEXmuyf2eBb2T4wFttafBPNfidwNqMo5rDzfvGnkYl1KzC:K5JyeQQ40ttrdkOhfOieEo |
| Threatray | 4'694 similar samples on MalwareBazaar |
| TLSH | T1B9355CC1B25088ABDB6B05F7B82A693021B66D5CA9FC810C5559761B25FB37120CFECF |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| File icon (PE): |  |
| dhash icon | eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | exe geo SnakeKeylogger TUR |
Intelligence
File Origin
# of uploads :
2
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
siparis belge.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-03-10 12:16:52 UTC
Tags:
snake keylogger trojan evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed strictor
Verdict:
Malicious
Labled as:
Strictor.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Status:
Malicious
First seen:
2023-03-10 05:30:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
34
AV detection:
18 of 22 (81.82%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 4'684 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5310184099:AAGxqu0IL8tjOF6Eq6x2u0gfcHhvuxRwfLU/sendMessage?chat_id=5350445922
Unpacked files
SH256 hash:
9edbd934432aec7cea74bd30ece7a1427bf698722f6777702893ff7dba3bbc76
MD5 hash:
54f348a137896af61a3600fc3afee2f8
SHA1 hash:
e17ff61c1349d8d1b0878a693380e5e4b1a70974
Detections:
snake_keylogger
Parent samples :
ad408414cfc70cdc2f0a28d95130cde8931e694f39699aa4dce91a8cc30a0897
5faf5c84d97d707f189a84dccca5a0b8fa1eb7b29d6d5b55ae442c36fd036e4e
a0b6669054d431660fa546b4daf93029d54ee64b65ea2f4443928b94099f1edd
b4d463f7b94cbcbdbe107d2ca3122ce3f0d04793f1fff3545b819698852311f7
a373532ccdd0f27818b1ab75eefe76ea788a277dcb79c019461f7991eaeb57a3
3d18203c206e8f36bf08d26ca150457d6cbd4f511d7cf4c6d3e688936f0b2767
813355fe326601b1d743b357c0a54915ce954270bf7eb9225a5cbe832c406ef8
cdc48b0fdaf20b7077c226d4b31c9d4765c985e99b8f9eea2d01676bab786f3a
485061f81c25d98b674e9031ecef0df3d18c3e353b70397e941b32783d1e5fb4
c80241ea11e21a083fc390af690cc0e6b2ee1ef91df4aaed6c44b10a753a1230
fb6cd7f254e2aef34975f6eb6c69586a7a10d059c52897221f286be3085dd5bc
c8fd56ab9f03dfe2772bc953ca3fa6dee35d7854594e194dc00cbe24f7a07a45
320e2a1e5cd7741bcec4c8f6d37527ea1905844247b1419e201104d8dd6e0fc5
c4fe62eb29c186a1455d5726899dc800964677384d47e09a2b0ba92161191ac8
f7f2e73a832d09d4ccda0e3d584eb40af695ed21726be42850f9ad0f4a4ed7dd
285442f66366aab5b789ec12e4e484b345f4c3a5e3357841507ccb0d0049ac0e
b0ceb7f37cc95869d4dbf51faa6ed5f5c2df7ac24bbba2b0f77dcca7471c9f59
f4b21e57bb6fabca1dd4b5499d5940749346c350975dcc07cf8f40db0376acfc
2ba96ffeb81c76fe74a0c12ceb229ab49654fa187e22d58dadaa443f2d4bfdd7
22312746d00896e37150b6c7ba5ad6588dd9f50e71e1e70d7745f5b820f05ff5
ae0a26ad0575bf99d4015962b33290c3bc1395b91a8355b5c9f2340fdf577db9
f218cb48273b179ab9c039a0422797a4f1a567cf893c12ce3e6d8b5bc0932b0c
24740eec512c214af4e012f2ec3bc79fdfd9912abd32b6d54b7e9ca1115407d0
94f0e85f9695ad67c878c255cf40a9ca5190b7a5178d6341d52b83813ea03d91
7083c8ed81099db6c891014f96b0a56b880ac92bcdc9c681869f74594c3a3a7b
f3d464c84f092c9d130b476fabc09c6224fb9e4a006c186a0c622d0b6b300c1c
0ec0958a4c7e436e35a3ee8c89d8b8f244189889dacf4ed86c9c2c86eb4d7bb0
5e5626f20b9483545487aabfd6744c421cf7f57da0afa01f15a9d7a7bcd41ee8
d7553cfd5b01d3836d3aa9f8bc0e2bda1efa9d6711cc9cea8d94093b64928655
36092694a2b80c584ba98d16b112b3202847072d164cdf8fdaab5c7fe2d3680c
60b3645a7d02232fd97ba076bdb88e6a801f462ce972d79366df9261a9f62720
f39c34f6567c6621290c4a7cdc7d6a436cec626f9d80aec20b508e1dc375432a
1148d4c103198f09735c2882ae5eb20e4fec6b5aa0b51c8fb83cfaf3a2b52875
45de7ab3655f4c09bbcd501ae053e80a699a507b16735d49cd4ea2185e754ab8
c73c24ee8f28c482040b1527599e0c0c3e65a93771425528ece99c48f932f1a2
519c5f8d463735bc7b6c925eba0b4e92bc49501cd7ae194e5756a988dc2c8202
caca41ded7766e3062137410ef48196855ed19f6f6f5acf7fe5a2031aea52361
ef69f6c6a455e85a49ae3de65eb978f623436b0e0620a95f55ac165955288b85
6e54bfee45fd919425b963e2a215b4f7850b38c9725cb5d799c55985096f7f89
0adef78d93aefbf2868d22e5e63265cc574c7fea255e903c0a8e936586ddaf1f
bcf7542267535648a505166fd17dad662fce6120a6b1f99635b7f406a224474a
5faf5c84d97d707f189a84dccca5a0b8fa1eb7b29d6d5b55ae442c36fd036e4e
a0b6669054d431660fa546b4daf93029d54ee64b65ea2f4443928b94099f1edd
b4d463f7b94cbcbdbe107d2ca3122ce3f0d04793f1fff3545b819698852311f7
a373532ccdd0f27818b1ab75eefe76ea788a277dcb79c019461f7991eaeb57a3
3d18203c206e8f36bf08d26ca150457d6cbd4f511d7cf4c6d3e688936f0b2767
813355fe326601b1d743b357c0a54915ce954270bf7eb9225a5cbe832c406ef8
cdc48b0fdaf20b7077c226d4b31c9d4765c985e99b8f9eea2d01676bab786f3a
485061f81c25d98b674e9031ecef0df3d18c3e353b70397e941b32783d1e5fb4
c80241ea11e21a083fc390af690cc0e6b2ee1ef91df4aaed6c44b10a753a1230
fb6cd7f254e2aef34975f6eb6c69586a7a10d059c52897221f286be3085dd5bc
c8fd56ab9f03dfe2772bc953ca3fa6dee35d7854594e194dc00cbe24f7a07a45
320e2a1e5cd7741bcec4c8f6d37527ea1905844247b1419e201104d8dd6e0fc5
c4fe62eb29c186a1455d5726899dc800964677384d47e09a2b0ba92161191ac8
f7f2e73a832d09d4ccda0e3d584eb40af695ed21726be42850f9ad0f4a4ed7dd
285442f66366aab5b789ec12e4e484b345f4c3a5e3357841507ccb0d0049ac0e
b0ceb7f37cc95869d4dbf51faa6ed5f5c2df7ac24bbba2b0f77dcca7471c9f59
f4b21e57bb6fabca1dd4b5499d5940749346c350975dcc07cf8f40db0376acfc
2ba96ffeb81c76fe74a0c12ceb229ab49654fa187e22d58dadaa443f2d4bfdd7
22312746d00896e37150b6c7ba5ad6588dd9f50e71e1e70d7745f5b820f05ff5
ae0a26ad0575bf99d4015962b33290c3bc1395b91a8355b5c9f2340fdf577db9
f218cb48273b179ab9c039a0422797a4f1a567cf893c12ce3e6d8b5bc0932b0c
24740eec512c214af4e012f2ec3bc79fdfd9912abd32b6d54b7e9ca1115407d0
94f0e85f9695ad67c878c255cf40a9ca5190b7a5178d6341d52b83813ea03d91
7083c8ed81099db6c891014f96b0a56b880ac92bcdc9c681869f74594c3a3a7b
f3d464c84f092c9d130b476fabc09c6224fb9e4a006c186a0c622d0b6b300c1c
0ec0958a4c7e436e35a3ee8c89d8b8f244189889dacf4ed86c9c2c86eb4d7bb0
5e5626f20b9483545487aabfd6744c421cf7f57da0afa01f15a9d7a7bcd41ee8
d7553cfd5b01d3836d3aa9f8bc0e2bda1efa9d6711cc9cea8d94093b64928655
36092694a2b80c584ba98d16b112b3202847072d164cdf8fdaab5c7fe2d3680c
60b3645a7d02232fd97ba076bdb88e6a801f462ce972d79366df9261a9f62720
f39c34f6567c6621290c4a7cdc7d6a436cec626f9d80aec20b508e1dc375432a
1148d4c103198f09735c2882ae5eb20e4fec6b5aa0b51c8fb83cfaf3a2b52875
45de7ab3655f4c09bbcd501ae053e80a699a507b16735d49cd4ea2185e754ab8
c73c24ee8f28c482040b1527599e0c0c3e65a93771425528ece99c48f932f1a2
519c5f8d463735bc7b6c925eba0b4e92bc49501cd7ae194e5756a988dc2c8202
caca41ded7766e3062137410ef48196855ed19f6f6f5acf7fe5a2031aea52361
ef69f6c6a455e85a49ae3de65eb978f623436b0e0620a95f55ac165955288b85
6e54bfee45fd919425b963e2a215b4f7850b38c9725cb5d799c55985096f7f89
0adef78d93aefbf2868d22e5e63265cc574c7fea255e903c0a8e936586ddaf1f
bcf7542267535648a505166fd17dad662fce6120a6b1f99635b7f406a224474a
SH256 hash:
9e0a6ad3409a57cc741f6427dce6ac588a364ce8707a2cfc898d0d7ef933e3ac
MD5 hash:
33f7837810e121dc02fc0c371d31dadd
SHA1 hash:
01c32719c480b58c20b067821ee6b479a7ea562d
SH256 hash:
c234684a33231d86ca3a0c6459d4fc982bfd2516807b0022d9094868d2111719
MD5 hash:
33846e3d38c36db71b091f1d26d97491
SHA1 hash:
a92e54e4016e792bd11828e92c66684f69309ea2
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
SH256 hash:
771a10bc428a77970df7838f41cf2206517c65e0c4af987886640832287154d7
MD5 hash:
cb8a555596a3dc3b21d66daca7bbf191
SHA1 hash:
81d887f08fea832b5224c10abb3601d8292f27ad
SH256 hash:
c80241ea11e21a083fc390af690cc0e6b2ee1ef91df4aaed6c44b10a753a1230
MD5 hash:
c1cb1b7d55e1e940b20e8e950c89691a
SHA1 hash:
093fdb2c0c27a3529334ba633dbfa8d796777e61
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.