MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8b2192f933e3b3124abbf20d43e8de51cfceea1469ef40413d3fc83d98c8d03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8b2192f933e3b3124abbf20d43e8de51cfceea1469ef40413d3fc83d98c8d03
SHA3-384 hash: acb0e2d06398cc4b05628962b576c799d0dd04183ad36fe2a03f2d25c1da896db88dac6598fe0554a7393ef3a0151300
SHA1 hash: 513f0295291ef1640fc5ead9379ba8cde19200c3
MD5 hash: 5b3f3d094c10b6aac465b3f6a7a6899a
humanhash: venus-montana-may-indigo
File name:Payment Details.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:532'409 bytes
First seen:2021-07-07 05:46:57 UTC
Last seen:2021-07-07 12:11:58 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:Egi7Ogy3LKxMVoA08OsyHNsk/i+ycojqSRPF2RuWUJilolg/A2sCUsojDmdpvk2A:W8oA5yHNsX+dRtUJilVsHE/HixN
TLSH 0EB423693B41C22B7FDABE0F4607202D294995F3D7B942BA01406992D7EF2DD35F2E08
Reporter cocaman
Tags:SnakeKeylogger zip


Avatar
cocaman
Malicious email (T1566.001)
From: "mahendrakr.sharma@nbcbearings.in" (likely spoofed)
Received: "from nbcbearings.in (unknown [185.222.57.89]) "
Date: "07 Jul 2021 07:57:53 +0200"
Subject: "RE: Payment Details - 0000012638 "
Attachment: "Payment Details.zip"

Intelligence

File Origin
# of uploads :
3
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2265.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c8b2192f933e3b3124abbf20d43e8de51cfceea1469ef40413d3fc83d98c8d03
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8b2192f933e3b3124abbf20d43e8de51cfceea1469ef40413d3fc83d98c8d03/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-07-07 01:23:50 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
2 of 46 (4.35%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zczbsl4thy5tcjflx4qnipun4uopz3vbi2ppibat2p6ihwmmrubq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger evasion keylogger spyware stealer
Link:
https://tria.ge/reports/210707-z5n1wlfmze/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Maps connected drives based on registry
Checks BIOS information in registry
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c8b2192f933e3b3124abbf20d43e8de51cfceea1469ef40413d3fc83d98c8d03

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip c8b2192f933e3b3124abbf20d43e8de51cfceea1469ef40413d3fc83d98c8d03

(this sample)

SnakeKeylogger

Executable exe 9b4114e6fe6ba27e85c1a7c7300c7489971762781773fa86c604b501fd924a20

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b4114e6fe6ba27e85c1a7c7300c7489971762781773fa86c604b501fd924a20
  
Dropping
SnakeKeylogger

Comments