MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 15

Intelligence 15 IOCs YARA 11 File information Comments 1

SHA256 hash:	cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf
SHA3-384 hash:	89667489249b84c87593f825914763fc385a5ae1f4e26cc73e5d9d5b97ecede9da32b79660f5e4ff0e1d381b64a06e05
SHA1 hash:	d98fe7072196e71d5cb8388a7f6d62344ab382d9
MD5 hash:	e1cf59372694c7d46d84d0139b40d41b
humanhash:	fix-idaho-massachusetts-nuts
File name:	e1cf59372694c7d46d84d0139b40d41b
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	894'976 bytes
First seen:	2023-02-01 15:54:12 UTC
Last seen:	2023-02-01 17:36:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:GWcoiHoylpLYR7aV0Hp615ExN0nmjkYIZsiSbHRry5rWeh3ih9HeA6RYcJbezuyc:GNoizkO0Hp5JyZAbHReBYTf6RBo
Threatray	6'902 similar samples on MalwareBazaar
TLSH	T17715DF593F248E91EA5602B621B40C3837312D2D608ED7091BC5B7DB4AFF3BD7D1299A
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	b270f0f0f8f07092 (19 x SnakeKeylogger, 4 x AgentTesla)
Reporter	zbetcheckin
Tags:	32 exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

191

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e1cf59372694c7d46d84d0139b40d41b

Verdict:

Malicious activity

Analysis date:

2023-02-01 15:54:52 UTC

Tags:

evasion trojan snake keylogger

Link:

https://app.any.run/tasks/806cb1fc-fea5-4da0-919f-c6d0022be7a2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/359130/

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.97107.22209.16025.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Launching a process

Creating a process with a hidden window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed strictor

Link:

https://www.filescan.io/uploads/63da8b57447edb203a0264a9/reports/041b7bbf-251b-43c4-8c6c-d0230f445c0c/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e7a317d9-dd31-47e5-aa5d-5d679247a53a

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1163565

Signature

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-01-30 18:15:06 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zwf6gxp5tz22md27dku3sucieo4iouz7eidbpzssitvz3cqprlhq._file

Verdict:

malicious

SnakeKeylogger

196135e36e7b2a6c13b68f0e22bbebbf93f9b4925911adaa72d775629d74dfcf

SnakeKeylogger

1f4266192080bd75e3d6553b92693a02cdd10d3d5fd6945f1995f5563d57095b

SnakeKeylogger

324c3680a1522f4d16471daf7537cfb9e280bc8f71ab5e4f4d39a89789cbf112

SnakeKeylogger

56d6ec04e6da2da0b7350720d5df69809fe2ea24dfac850ebd8f7ae89159f689

SnakeKeylogger

7ecc0fccd1cef94795ada4dfcd7f03426b589c0abcc5a1a2979232c4df47d9ff

SnakeKeylogger

dcff2f1adb183112521e7b484dc2fff1bf98316fcc38f4c06eb0e39c416fa3dc

SnakeKeylogger

fd57c25c7f4a591450adba8e8f2755e6a8ef62e9e28b745eae0a7369dc5ef4aa

SnakeKeylogger

+ 6'892 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/230201-tcr3nacd6v/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Unpacked files

SH256 hash:

178cc7474b323b0ae6b3095ff67127726530d9d44be5cb58ba7315ef3a1199ad

MD5 hash:

159af9cf7f94d64c8120c80268965306

SHA1 hash:

fb41ab37af2c83e96d97e9cd066f90e72d4887ea

Link:

https://www.unpac.me/results/191f58c9-4fea-45b0-aa47-607a17b84515/

SH256 hash:

25b72dc82fb1036fa9d01c3c23a6a13846c8de929c78de09719d579490ba29d7

MD5 hash:

4d2aee2d713793c8b36f07c302d2719e

SHA1 hash:

453d36ae055ff6c606cbde078a4dd5b89b8ce6e4

Link:

https://www.unpac.me/results/191f58c9-4fea-45b0-aa47-607a17b84515/

SH256 hash:

ef780426bdd87100700761f7f08d8d670f1628d1d4069658a162ffcd9ef73d35

MD5 hash:

8b0869a6bb068018cfe317f28d10bb29

SHA1 hash:

26e8b144715d995cfba82606cf7c8230adef74ba

Link:

https://www.unpac.me/results/191f58c9-4fea-45b0-aa47-607a17b84515/

SH256 hash:

659034afbb161464cee025fb0af320aae9ca4efd104f566a3c332305e78615f6

MD5 hash:

4c2cc512d8b2e6a356c375b6c449e359

SHA1 hash:

17b54bc9385109420abc051498729046b49db00d

Link:

https://www.unpac.me/results/191f58c9-4fea-45b0-aa47-607a17b84515/

SH256 hash:

be7e692adb6ddc9a95f4c7e98c4cfd1fa5a7638b91d8fa93b39db027f0f4e60b

MD5 hash:

93457c22f23698ae2541ee2162aca0e6

SHA1 hash:

13bfcd1c4ed7ad871b8fa1bd3a3082eaf8b5556f

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/191f58c9-4fea-45b0-aa47-607a17b84515/

Parent samples :

1c1205143aa726f39d6efeea85dcc4273f02936241432112d00b2c7c67ff1d9c
cfdb70e6469751ee66793a4c32efa8bcf3de901c0dfe422cba0679b65d13622f
9ad926f89e44d67df18c880a39ccc198f13b9bb53f6e71bf8d0caa82b56bf84b
7901e6da6fafe2cb3a44e0aa7fdd00b589faea5a8a512eb93fcdd6d5c6794a4d
be7e692adb6ddc9a95f4c7e98c4cfd1fa5a7638b91d8fa93b39db027f0f4e60b
b335599221fe1c56a3783a220c80766f93085f62d6d73ff7757d0908ca4efd35
0f629bc76705145918a6c04774ade9c99b4ed06c6d96424a0bf9207c442807d7
e9bd723975e0a440e52c11f8df79d37e0607bd20cac3daff0661c4bb0ab7f129
cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf

SH256 hash:

cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf

MD5 hash:

e1cf59372694c7d46d84d0139b40d41b

SHA1 hash:

d98fe7072196e71d5cb8388a7f6d62344ab382d9

Link:

https://www.unpac.me/results/191f58c9-4fea-45b0-aa47-607a17b84515/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cd8be35dfd9e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

exe cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2525321/

Cape

https://www.capesandbox.com/analysis/359130/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-02-01 15:54:15 UTC

url : hxxp://192.3.193.148/them.exe