MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
SHA3-384 hash: a74e7cd42b8d1c9049f566d57e7232c48bb1580685600c86afd6596de6a5e1f9f61c485b83dc14f025e293c5bd0013d2
SHA1 hash: 9547ecc6caf8ed15adca89d880c5f80703d25e38
MD5 hash: bafb667680a0d2eb5c5671e111361d38
humanhash: rugby-apart-blue-moon
File name:bafb667680a0d2eb5c5671e111361d38.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:579'584 bytes
First seen:2023-07-09 06:18:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:g4UZujY20ar/955SRwwh8BG7gYkJGr2qvhb1y:SujS495cKwYGEYaqvR
Threatray 5'432 similar samples on MalwareBazaar
TLSH T18EC4483C18BD5323C174C2B6CFD5D723B254946F3162AA765DC39BA64796E022AC323E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
218570262-051525-sanlccjavap0004-14036.rar
Verdict:
Suspicious activity
Analysis date:
2023-07-07 07:16:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c11fd7e5-e246-4e4c-8d01-7902fd9dca04

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/412226/
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILMamut.11514.24128.12138.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Sending an HTTP GET request
Enabling the 'hidden' option for analyzed file
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64aa515c0e49d672f31ec3b7/reports/3713eb92-38d5-443b-9cc7-11465da526cb/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/012968c6-4824-4927-a2d7-2c8461edbbd2
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1271154
Signature
.NET source code contains very large strings
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-01 14:26:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2htmdks6tosyd54lwatqyvpzjxcqcp25krvneuso7nvqaxoog3ua._file
Verdict:
malicious
Similar samples:
28be2ad894979fa94ed9dbbfa7ced6119ade5898db63a5ab4576191da0409266
SnakeKeylogger
465f7a28242d2bcfa2ea5a965667f9d71c6a7e712da370a9a92b364180e2d729
SnakeKeylogger
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
SnakeKeylogger
9b481ce4b3cb66b4325b09a71c65f202b2da68b1cc9f04cbfd5ad2043cd9ddee
SnakeKeylogger
a6c27889d98c772883860f4048d7ace2989a6a2967ce790c023203f56ae7ded3
SnakeKeylogger
a7df5eb83434a5da24e394b94c775957e42ca3b36f3f76c582af50eeed525693
SnakeKeylogger
c4c920d6d5d253db092a28210596c60b4377224251c3d14c4558a54346a71b75
SnakeKeylogger
c8f4d475fb49c545a0cf3137ba0078a30f668fd5f638d3d5a4744c76f3db74b5
SnakeKeylogger
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
SnakeKeylogger
+ 5'422 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230709-g26wwsah79/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
862f3cd524b29fc5b6ced9cfc4d13756cb90d6c95ca50fd2438e2d5df44bbf05
MD5 hash:
8ade068b8a62b6173f1d3e07bf0a7e04
SHA1 hash:
b63b1dddf4358e8826dab84e4206137d41718592
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
Parent samples :
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
d2ed2fe66a89a05c02510dabf4360f8fe54f6f27e94ccd864c56beaf218229e3
14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059
d757716097082fdcf35033613d1736f4cf02f07afb368b1381489ba8ebba3cb0
48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e
SH256 hash:
5f65168ed739e80749a0ffd0420239759f6281730fe5d9c0277049e1c92b7363
MD5 hash:
d49a2cd4ff74076a272c08272971dc3b
SHA1 hash:
a74c0b9b9b635e4d857aae3a5a2e1622570be8cc
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
4beb97f50324c840d1bc6dc41e5962059ed45272302a8c8f093d001ab7532951
MD5 hash:
807a9bb2b55af8df7aef1dfcb897eefc
SHA1 hash:
1792411ea0ea4188d0fb982ca0eed418852df864
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
862f3cd524b29fc5b6ced9cfc4d13756cb90d6c95ca50fd2438e2d5df44bbf05
MD5 hash:
8ade068b8a62b6173f1d3e07bf0a7e04
SHA1 hash:
b63b1dddf4358e8826dab84e4206137d41718592
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
Parent samples :
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
d2ed2fe66a89a05c02510dabf4360f8fe54f6f27e94ccd864c56beaf218229e3
14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059
d757716097082fdcf35033613d1736f4cf02f07afb368b1381489ba8ebba3cb0
48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e
SH256 hash:
5f65168ed739e80749a0ffd0420239759f6281730fe5d9c0277049e1c92b7363
MD5 hash:
d49a2cd4ff74076a272c08272971dc3b
SHA1 hash:
a74c0b9b9b635e4d857aae3a5a2e1622570be8cc
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
4beb97f50324c840d1bc6dc41e5962059ed45272302a8c8f093d001ab7532951
MD5 hash:
807a9bb2b55af8df7aef1dfcb897eefc
SHA1 hash:
1792411ea0ea4188d0fb982ca0eed418852df864
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
862f3cd524b29fc5b6ced9cfc4d13756cb90d6c95ca50fd2438e2d5df44bbf05
MD5 hash:
8ade068b8a62b6173f1d3e07bf0a7e04
SHA1 hash:
b63b1dddf4358e8826dab84e4206137d41718592
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
Parent samples :
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
d2ed2fe66a89a05c02510dabf4360f8fe54f6f27e94ccd864c56beaf218229e3
14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059
d757716097082fdcf35033613d1736f4cf02f07afb368b1381489ba8ebba3cb0
48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e
SH256 hash:
5f65168ed739e80749a0ffd0420239759f6281730fe5d9c0277049e1c92b7363
MD5 hash:
d49a2cd4ff74076a272c08272971dc3b
SHA1 hash:
a74c0b9b9b635e4d857aae3a5a2e1622570be8cc
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
862f3cd524b29fc5b6ced9cfc4d13756cb90d6c95ca50fd2438e2d5df44bbf05
MD5 hash:
8ade068b8a62b6173f1d3e07bf0a7e04
SHA1 hash:
b63b1dddf4358e8826dab84e4206137d41718592
Detections:
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
Parent samples :
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
d2ed2fe66a89a05c02510dabf4360f8fe54f6f27e94ccd864c56beaf218229e3
14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059
d757716097082fdcf35033613d1736f4cf02f07afb368b1381489ba8ebba3cb0
48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
5f65168ed739e80749a0ffd0420239759f6281730fe5d9c0277049e1c92b7363
MD5 hash:
d49a2cd4ff74076a272c08272971dc3b
SHA1 hash:
a74c0b9b9b635e4d857aae3a5a2e1622570be8cc
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
4beb97f50324c840d1bc6dc41e5962059ed45272302a8c8f093d001ab7532951
MD5 hash:
807a9bb2b55af8df7aef1dfcb897eefc
SHA1 hash:
1792411ea0ea4188d0fb982ca0eed418852df864
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
4beb97f50324c840d1bc6dc41e5962059ed45272302a8c8f093d001ab7532951
MD5 hash:
807a9bb2b55af8df7aef1dfcb897eefc
SHA1 hash:
1792411ea0ea4188d0fb982ca0eed418852df864
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
SH256 hash:
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
MD5 hash:
bafb667680a0d2eb5c5671e111361d38
SHA1 hash:
9547ecc6caf8ed15adca89d880c5f80703d25e38
Link:
https://www.unpac.me/results/f652f9c9-fdb7-4c8b-ba16-7c3c4c16ac80/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d1e6c1aa5e9b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/412226/

Comments