MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d4ba9b24d1e97b8a0872f8124104f4e48491eaf601b4087abb5b0407cf5f2417. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 6
| SHA256 hash: | d4ba9b24d1e97b8a0872f8124104f4e48491eaf601b4087abb5b0407cf5f2417 |
|---|---|
| SHA3-384 hash: | 3891152eb7b8aa0ff026c4597a56493cbfa316c60edb5414bc11465e4a05fa15f5058d4a18bd9f5764244d74d1d629c3 |
| SHA1 hash: | 2b1398ec093c8a8fa6a1241125965e74c88c3938 |
| MD5 hash: | fc479068aca098d87db4f054a0163e11 |
| humanhash: | blue-sierra-solar-equal |
| File name: | ORDER#75647834984.zip |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 963'372 bytes |
| First seen: | 2021-12-15 06:08:30 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 24576:0zMEZHq/BXjzfRU/+iHyauw/mQpKQnoI2JaHbGe+Zht:pEtqdz5cNtufinol4PSz |
| TLSH | T19A25331D9CCE53941AFBA47F2256127947F857099A88AF0AE39DF6F264BD00D9C301E3 |
| Reporter |  cocaman |
| Tags: | SnakeKeylogger zip |
cocaman
Malicious email (T1566.001)From: "Mansoor Ali <Ali@dgfxbvo.bar>" (likely spoofed)
Received: "from hp0.dgfxbvo.bar (unknown [143.198.55.73]) "
Date: "15 Dec 2021 07:07:52 +0100"
Subject: "NEW ORDER 75647834984"
Attachment: "ORDER#75647834984.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Status:
Malicious
First seen:
2021-12-15 06:09:13 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
25 of 45 (55.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection evasion keylogger spyware stealer
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendMessage?chat_id=1063661839
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.