MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9ab4dba9b10e882c2ea49177ad2f66cc4370c395c7e4b4199a3b268b40f89dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9ab4dba9b10e882c2ea49177ad2f66cc4370c395c7e4b4199a3b268b40f89dd
SHA3-384 hash: 4aaa2c30fc5ebdd722057200118036b5a11f2685ad98647869401935bb0af5596ce4ed90c296b115bfb111cabc23fc8a
SHA1 hash: def67a6a5f2776b6896af9f225db08302d102eed
MD5 hash: 5ff453f70c3050967c58db949e47cd4c
humanhash: lactose-fillet-video-avocado
File name:triage_dropped_file
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'579'008 bytes
First seen:2021-07-26 12:59:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:upaLW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huD:qxieciF8Nts+KfNQuiNB/e
Threatray 362 similar samples on MalwareBazaar
TLSH T1DD75E80C6DDEB26BF65B11BC356C10D85066FC19C708ADB7AE0ABBF67062E95503B087
dhash icon f0dcf8dcdcd0ccf0 (13 x AgentTesla, 6 x Formbook, 4 x Loki)
Reporter malwarelabnet
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
triage_dropped_file
Verdict:
Malicious activity
Analysis date:
2021-07-26 14:52:24 UTC
Tags:
evasion trojan snakekeylogger keylogger
Link:
https://app.any.run/tasks/2790aeb6-fb23-46a6-9995-d00e2337557e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/174117/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.DZG.6478.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/66c88113-8b48-4dd9-8ff4-0821dc674afe
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/821770
Signature
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-26 03:15:18 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zgvu3ou3cduifqxkjelxvuxwntcdodbzlr7ewqmzuozgrnaprhoq._file
Verdict:
malicious
Similar samples:
3de2043d5dc6aa1879f040d9c69e905424acabe29ac4162752bbf57f83ae58a6
SnakeKeylogger
578aa3607cb34fde024d099b916e61c0a767d952312a2e8c9276f3167a65ad14
SnakeKeylogger
69950e3903237ab9d6441a23af192268cf49da8e1034f77990833a60738090a6
SnakeKeylogger
ad060fffb69419f682cc68d3aa4034b04466c11228bd7e93b6c43755e0a237e3
SnakeKeylogger
b5e1daebfb2aa234328dc9776a1ecc77dd2726a7709c353c0265d8b1f4803f1c
SnakeKeylogger
b9acd58a25a9493713c0b5a3be62db4338de550aad1b23054d4be3de0c1b0c46
SnakeKeylogger
c39703a0644e67f2c3486446350a71c559d3f35414df73dbcde3fb731948eb2f
SnakeKeylogger
c4e1ba047b2fa0d07de6a124e882025489d5ff95e2a2cef31c4526199636f3cd
SnakeKeylogger
dc5458e66a8c76f55a5f490f5c9d12ea6e92a67c6ed74dbe40ca066a149d1659
SnakeKeylogger
e0c5194ec5dd17f0a5f77c156e99deafdee0c6e25b5c54c4bedc7bc5420f3a1d
SnakeKeylogger
+ 352 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210726-zwcl5krhre/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
4d6059bed77ebadb70092bd7a51de904ebb17ac822e22a08ee4c09352ae1e1c2
MD5 hash:
b0e4b1137e65d45c44f2a11575569aec
SHA1 hash:
d15be341c460239832bfae095e37850bd97015ce
Link:
https://www.unpac.me/results/a8970618-de72-4493-9c05-869dd052b675/
SH256 hash:
4f50d16cc0d8c7b3c5a0f09340c4165c10c76ba3b2cab9d5130a8d1db75eee98
MD5 hash:
a20c6719c7e83c236531d11538490500
SHA1 hash:
b92a60ed7d78d6befd9027b01a56f75db913f0fc
Link:
https://www.unpac.me/results/a8970618-de72-4493-9c05-869dd052b675/
SH256 hash:
51d1f6895958cdba1a2d8f63233795e9581c684ee84fde67e4b1e364a8bb1497
MD5 hash:
e7c1a4e19e11d43365412dccd004412c
SHA1 hash:
a38a5d7839b9aa191ac5bad3db3926b120b96859
Link:
https://www.unpac.me/results/a8970618-de72-4493-9c05-869dd052b675/
SH256 hash:
de5789174361d73723459b063a161d22943076a69b31ce2dbfe554fd6a77bb35
MD5 hash:
4c18fbb276f17c0361c3ae33b6c95219
SHA1 hash:
f7b7b2e7b041620063acd74d16308ee6044506ea
Link:
https://www.unpac.me/results/a8970618-de72-4493-9c05-869dd052b675/
SH256 hash:
c9ab4dba9b10e882c2ea49177ad2f66cc4370c395c7e4b4199a3b268b40f89dd
MD5 hash:
5ff453f70c3050967c58db949e47cd4c
SHA1 hash:
def67a6a5f2776b6896af9f225db08302d102eed
Link:
https://www.unpac.me/results/a8970618-de72-4493-9c05-869dd052b675/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/c9ab4dba9b10e882c2ea49177ad2f66cc4370c395c7e4b4199a3b268b40f89dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/174117/

Comments