MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c80bb9c44bf2a708e03c98522b23bd53a96f627c9c4f26bbc4d761b5d885a537. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 15
| SHA256 hash: | c80bb9c44bf2a708e03c98522b23bd53a96f627c9c4f26bbc4d761b5d885a537 |
|---|---|
| SHA3-384 hash: | fc16867c1ed656f40bd7c1ad711870888ccb14bd23880fd1e8c47b869c2511fe30e32d2218d55a532bb1d3c2fe18d4ab |
| SHA1 hash: | 14fe8c5dee3aae864767d3d2d2d542056802bc08 |
| MD5 hash: | db25309e5d8f0476ea9bd69d0a8685a8 |
| humanhash: | oscar-virginia-music-arizona |
| File name: | Purchase 180423.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 663'040 bytes |
| First seen: | 2023-04-19 16:01:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 6144:+gDStNkyCoAPblDOLb0ih+fH0XwffIHYZqLfbU4TPla31i6JfkWJoFbLKn/dqkL+:+g+koi1HwUqLfbDTI30+WvKgkLLJd5w |
| Threatray | 5'120 similar samples on MalwareBazaar |
| TLSH | T126E4AE1E31679B4AC26EE7F5106468713BB06283376DC27DACC743CB9ABAF01168535B |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
211
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase 180423.exe
Verdict:
Malicious activity
Analysis date:
2023-04-19 16:15:48 UTC
Tags:
snake keylogger trojan evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
floxif lokibot packed virus
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 5'110 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
2aacb90cbca333fc849c01ba65a6994cb09803ec960477e79317161ad1073b2f
MD5 hash:
b01df9f87c138bb4a1cb594e7391a135
SHA1 hash:
b8c0ba18fbd31335afcd81bdc05325bddf6aff10
SH256 hash:
0fd1f00d94aff36ad8f02077efb33ddf269985ea37038aae554ff6202fdc020f
MD5 hash:
8dfd8e44c82066f4aeeff652fa2a33c5
SHA1 hash:
b844952e48ecab0e7ab2e3d5e38a20629399f94c
SH256 hash:
e2e91e3fe13ad090ad954ecf18b887b0dc0313f9d54aefa21728c3cadf96f6ee
MD5 hash:
cef626bf0c19571f221b1333fed197f3
SHA1 hash:
a07864aab8b117c2d5fe93dce5aa4fdec6aca7ac
Detections:
snake_keylogger
SH256 hash:
01e71d6928d097437631a3e1729739ad0445dbbdcf50b77a4b83ab28f680f69c
MD5 hash:
7ac4e6b26cf6e7f0b0d002fb386848c8
SHA1 hash:
6eb9deaa45643967e172d9e8eec10534bc8f19d5
SH256 hash:
cb11a0547947d9dc7bc1bb9dff29d23d1f54a361a54cb1fa30728e02558e0888
MD5 hash:
93c54ce01805ec6e474d9ff22d83f69b
SHA1 hash:
2b061f047f0bd7e61f6e2670a64cf027ed8f3601
SH256 hash:
c80bb9c44bf2a708e03c98522b23bd53a96f627c9c4f26bbc4d761b5d885a537
MD5 hash:
db25309e5d8f0476ea9bd69d0a8685a8
SHA1 hash:
14fe8c5dee3aae864767d3d2d2d542056802bc08
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.