MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c826fb41bb3b7945a1f6d9d3562025fc294a9ddfc90f2cbabef245a491bb1267. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c826fb41bb3b7945a1f6d9d3562025fc294a9ddfc90f2cbabef245a491bb1267
SHA3-384 hash: 51d4504ea6f4933c321588ee768f25727a0fad7e6e221c5e2756e458b65b9b8ccf166e91d505811cbd716e708b812eee
SHA1 hash: 05cbc738c38f9c2a8601d51697fa292e9491116b
MD5 hash: 90e9189e8cfacb33b390378b7b21be36
humanhash: uranus-west-kilo-west
File name:477120227 PEDIDO DE COMPRA.r11
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:638'297 bytes
First seen:2022-07-12 06:17:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:19uBQwQZM+Xk3mF3U+GcBc3uYLwiuJ+Zfe0ZVJCBezp7yXINlVrhdxm:19uvXH030c636anQBJINjrhfm
TLSH T13BD43377B260E63A5670B3D53FCCA0EE077127F76123D0484D6B81651ADE231A1EB2E6
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:r11 rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "OROZCO Cira <cira.orozco@rodiosbo.com>" (likely spoofed)
Received: "from rodiosbo.com (unknown [45.137.22.75]) "
Date: "11 Jul 2022 13:48:07 +0200"
Subject: "None"
Attachment: "477120227 PEDIDO DE COMPRA.r11"

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c826fb41bb3b7945a1f6d9d3562025fc294a9ddfc90f2cbabef245a491bb1267/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 13:33:02 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zatpwqn3hn4ulipw3hjvmibf7quuvho7zehszov66jc2jen3cjtq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220712-g2lkyshbd9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/c826fb41bb3b7945a1f6d9d3562025fc294a9ddfc90f2cbabef245a491bb1267

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar c826fb41bb3b7945a1f6d9d3562025fc294a9ddfc90f2cbabef245a491bb1267

(this sample)

SnakeKeylogger

Executable exe c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7725dacf76779cf2802a0dcc23598cbc1d5f5d7a1dad90a3fbadfa5bf21d825
  
Dropping
SnakeKeylogger

Comments