MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 12

Intelligence 12 IOCs YARA 11 File information Comments

SHA256 hash:	d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5
SHA3-384 hash:	e04f6e013bba63bb09f5777fa4e6cf627fa1bede5dfca601551fba4edb7976af6112be22ed6ad9d0b9ac54ea84060670
SHA1 hash:	026793e205705a459366572d889740e40187ff97
MD5 hash:	c98a54b6bbda6d4e4595118b616796a9
humanhash:	leopard-lake-ten-india
File name:	CaixaBank _ banca digital CaixaBankNow.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	593'920 bytes
First seen:	2023-05-23 11:31:31 UTC
Last seen:	2023-05-23 12:25:11 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:/B0+ng4sPP+2ODoEIEatytQDNQWtDXBN6sO59q5efm8opJxDNk6JuA8rv/XxRiSf:q+nnsniDSzDp1RAPoki3xDNHAvpBws
Threatray	5'599 similar samples on MalwareBazaar
TLSH	T102C4E16B1B5F8832C46506F8A526E2FE91323FE42637C32AE9E77C63F5793435805096
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	68ec9acaabd0dcf0 (12 x Loki, 8 x AgentTesla, 4 x Formbook)
Reporter	abuse_ch
Tags:	CaixaBank ESP exe geo SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

277

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

CaixaBank _ banca digital CaixaBankNow.exe

Verdict:

Malicious activity

Analysis date:

2023-05-23 11:34:31 UTC

Tags:

snake keylogger trojan evasion

Link:

https://app.any.run/tasks/18c6b08b-4a06-4ee7-a90b-5673e96d7b59

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.2042.29316.30836.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Unauthorized injection to a recently created process

Creating a file

Enabling the 'hidden' option for analyzed file

Moving of the original file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

comodo formbook packed remcos

Link:

https://www.filescan.io/uploads/646ca4331484457301bc5328/reports/56c5875c-f9ef-4e77-b8ba-8ac05c34bd3f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e9721129-6003-4eb1-a823-34ff4500f53e

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1240740

Signature

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Moves itself to temp directory

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-05-23 03:12:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 23 (69.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2hcmpz72xu6dnam3cqgbafz3jnmu2kfi52mguuvyp2rpmse3272q._file

Verdict:

malicious

SnakeKeylogger

2a2a0d105987a84307292e9aea9d6e5b4ffd614994aefe408dc97a4356c7b59f

SnakeKeylogger

65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc

SnakeKeylogger

a21c508de19d0b316579d1686ef31559928d3d0c105e0f41b16aac61cb1218d9

SnakeKeylogger

c9a2e27125a45f8b667438d540f0a02e811331e008c9a3c145c36804f98144f7

SnakeKeylogger

cc51d10e5165cb6ba234e1ac9b831d9ba93c8cf678a12890ff712386a8346398

SnakeKeylogger

ce5cd95b8fa530b0b8abf93e5e373a6ad04e56173a702a0ae8ff4751bea38adb

SnakeKeylogger

d5f557e16db625fb63ce5b68ab5f68a77f68adbb7a93713c0bae67cb5762288b

SnakeKeylogger

db1514e42b561d3851aa327b612b8075d4b9387eb054dff98a7b1fe026238e35

SnakeKeylogger

ec1d8e37579205e9a77b181f281dfac637d28a5a446a03327698b8004e33249c

SnakeKeylogger

+ 5'589 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/230523-nm94bsfh7y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Unpacked files

SH256 hash:

938090c2f2c933d3492239bd8d1221ab4701678202f79365ce8c553a5cc54552

MD5 hash:

edc89e37e4070abf89fd7668c382ae66

SHA1 hash:

cdb736ab45f326eacdc803bfb93fd2b07a1327c7

Link:

https://www.unpac.me/results/a01aa55f-d71f-4094-8582-e3e9bd65a27e/

SH256 hash:

cb5ee4cfd7179a57298c02ce4ccc9c2ca6b0b310758a7320340cf0a40ab62f88

MD5 hash:

0dd66dbaf510e93ec00b9eadf5ec34b6

SHA1 hash:

b7e1b7bbf2d58cc03beeb7095ae98e03426f39a7

Link:

https://www.unpac.me/results/a01aa55f-d71f-4094-8582-e3e9bd65a27e/

SH256 hash:

16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d

MD5 hash:

fb4ed205b442f470bbf10913128efdcb

SHA1 hash:

9a0a4c5ae429769e3253a9a3daefa24270b87a5b

Link:

https://www.unpac.me/results/a01aa55f-d71f-4094-8582-e3e9bd65a27e/

Parent samples :

ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e

SH256 hash:

af7a2d9e3f3e313fd69f435428863a5ce7fe4756bde8f3e715d20721ae484c51

MD5 hash:

828456b4257a7a6d7532089382e200b2

SHA1 hash:

8913537ef741d56c6559933c695f8c2693472f84

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/a01aa55f-d71f-4094-8582-e3e9bd65a27e/

Parent samples :

db1514e42b561d3851aa327b612b8075d4b9387eb054dff98a7b1fe026238e35
65fbe4b33bfdd2491057338eb43f79d78b0942c7d9ac56a2806d7902a7c8ebcc
d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5
978a959c5131f0e37d076b6a2b777c35cae4f58756a3d25be2662e58301f0ebd
c4fce336f2e0a78838016ce095556c8d121801cc13547438f1b3464afab94b49
389cd12974a382686c0f491549b4bbe32c2dc9604b0b3a193ee4fb30ede8335d

SH256 hash:

51b42a8c9570a58f0c02a5772d7b07083bb1e578a46ffb7a7d522473af38c085

MD5 hash:

d3127f1b0d243db9fc7306a62f03451f

SHA1 hash:

2c81c0f2728862a8cf2952af98394b36ccb97e98

Link:

https://www.unpac.me/results/a01aa55f-d71f-4094-8582-e3e9bd65a27e/

SH256 hash:

d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5

MD5 hash:

c98a54b6bbda6d4e4595118b616796a9

SHA1 hash:

026793e205705a459366572d889740e40187ff97

Link:

https://www.unpac.me/results/a01aa55f-d71f-4094-8582-e3e9bd65a27e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Password Stealer

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

exe d1c4c7e7fabd3c36819b140c10173b4b594d28a8ee986a52b87ea2f6489bd7f5

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample