MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c
SHA3-384 hash: 42d59e9c6f7aa16167eea3ca12114976af2e5ce9a99a657d871eda8560e7dd912ce23a166ecf7dd8620485f1f755f389
SHA1 hash: 49eba037338ffe00fe2bc8cfa2fd1f1ff766cd21
MD5 hash: cc7db44f47c327ae05717f8512ba6f8e
humanhash: hotel-network-lamp-bulldog
File name:21168 PACKING LIST CMI 03092021.xls.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:519'168 bytes
First seen:2021-09-19 16:48:27 UTC
Last seen:2021-09-19 17:51:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:5obB8XC2X9S25SquioGetxTznyouSmSX7:5xy2X9FSquiwJ6k
Threatray 1'476 similar samples on MalwareBazaar
TLSH T1C0B42860156E7D75C0786B3A47B357E51BEEDC402A7ACF896B21F279003C6DB7E82206
dhash icon 70f09a5bbaaed451 (12 x SnakeKeylogger, 3 x AgentTesla, 1 x Formbook)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
21168 PACKING LIST CMI 03092021.xls.exe
Verdict:
Malicious activity
Analysis date:
2021-09-19 16:49:52 UTC
Tags:
evasion trojan snakekeylogger keylogger
Link:
https://app.any.run/tasks/c1d76314-a538-47d0-9b83-29a501819ef1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189112/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1032.21518.8710.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file in the %AppData% directory
Launching cmd.exe command interpreter
Creating a file in the %temp% directory
Delayed writing of the file
Forced shutdown of a system process
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5e46e9d8-9d2c-4f65-a28e-f419753592d3
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/853594
Signature
.NET source code references suspicious native API functions
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 486021 Sample: 21168 PACKING LIST CMI 0309... Startdate: 19/09/2021 Architecture: WINDOWS Score: 100 64 Found malware configuration 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 5 other signatures 2->70 8 uyfdfgh.exe 3 2->8         started        11 21168 PACKING LIST CMI 03092021.xls.exe 3 2->11         started        process3 signatures4 72 Multi AV Scanner detection for dropped file 8->72 74 Machine Learning detection for dropped file 8->74 13 vbc.exe 2 8->13         started        17 cmd.exe 1 8->17         started        19 cmd.exe 1 8->19         started        21 cmd.exe 1 8->21         started        23 vbc.exe 15 2 11->23         started        25 cmd.exe 3 11->25         started        28 cmd.exe 1 11->28         started        30 cmd.exe 1 11->30         started        process5 dnsIp6 52 checkip.dyndns.org 13->52 54 193.122.130.0, 49745, 80 ORACLE-BMC-31898US United States 13->54 56 172.67.188.154, 443, 49746 CLOUDFLARENETUS United States 13->56 76 Tries to steal Mail credentials (via file access) 13->76 78 Tries to harvest and steal ftp login credentials 13->78 80 Tries to harvest and steal browser information (history, passwords, etc) 13->80 32 conhost.exe 17->32         started        34 schtasks.exe 1 17->34         started        36 conhost.exe 19->36         started        58 checkip.dyndns.org 23->58 60 checkip.dyndns.com 158.101.44.242, 49739, 80 ORACLE-BMC-31898US United States 23->60 62 freegeoip.app 104.21.19.200, 443, 49740 CLOUDFLARENETUS United States 23->62 82 May check the online IP address of the machine 23->82 48 C:\Users\user\AppData\Roaming\uyfdfgh.exe, PE32 25->48 dropped 50 C:\Users\user\...\uyfdfgh.exe:Zone.Identifier, ASCII 25->50 dropped 38 conhost.exe 25->38         started        84 Uses schtasks.exe or at.exe to add and modify task schedules 28->84 40 conhost.exe 28->40         started        42 schtasks.exe 1 28->42         started        44 conhost.exe 30->44         started        file7 signatures8 process9 process10 46 conhost.exe 38->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-16 06:05:53 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ripukjl6i66ybz6wufkqtxichyf4pfwrzxqnnkf6qsbxhjppnoa._file
Verdict:
malicious
Similar samples:
36d0c6d5280a29e061d07ad6eac7236e063ee8023ac398bb6d3f34a3f8aacb83
SnakeKeylogger
55580a7b5ec8510e0bf498f20928778b6c7b2071a31d8332f809a7a718c66b48
SnakeKeylogger
599ed346c41bd6c8de85ce906bdf6b840f55383fa2fe25d272b30215c4331230
SnakeKeylogger
5b9eef2199515e5bf4cd00a176b35747f8bc9984183213fec864aca2c1918a70
SnakeKeylogger
71f5a0e02cfd97625bfaf4c5e48825b8b08262a7ac89f1b7f8ae82c1200205f8
SnakeKeylogger
a937ea15f15c9ea7ac496b540ff4243276746550d72b908d2151c2b4f9fc76bf
SnakeKeylogger
af41223eb9daa98fea5555e90a232634848bcc1801315a6f47edf20bbe086d3f
SnakeKeylogger
c92748428af1806d4ecc702bce8ad9abcac6b738e7208d3586450cb4944a87a9
SnakeKeylogger
cba897dc82a468040a082fd6135edecb8dcdcd0f0fe1375adeaeff3262cc6504
SnakeKeylogger
f051b1c9df37c1d4236c98b54883d4005572910949a1be18ab6ead13754147dc
SnakeKeylogger
+ 1'466 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210919-vbnvaacbh2/
Behaviour
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Uses the VBS compiler for execution
Executes dropped EXE
Snake Keylogger
Unpacked files
SH256 hash:
5cdddc20a4b8585ccb5dc83e9676a9d2350cbdaac7dc36d17dccf4212878e3ac
MD5 hash:
5627540b8d89ef1e3897054189a8e6c4
SHA1 hash:
3aed5c24830097be8964419d8d4457b11ae07001
Link:
https://www.unpac.me/results/658915cc-c05c-4d4c-b713-76f0186b1b61/
SH256 hash:
d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c
MD5 hash:
cc7db44f47c327ae05717f8512ba6f8e
SHA1 hash:
49eba037338ffe00fe2bc8cfa2fd1f1ff766cd21
Link:
https://www.unpac.me/results/658915cc-c05c-4d4c-b713-76f0186b1b61/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/189112/

Comments