MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1
SHA3-384 hash: 281acf168710e4ddd77be792a0c77528f7a6fcd61898dd7937a494955e7b1a1f7621192c98b5e86fedaef03b047f72f3
SHA1 hash: 946d162631de9d4a9cca53f22c600abedd226230
MD5 hash: 2bff9d309fb2e73e5228937a4838dd79
humanhash: quebec-asparagus-mike-oven
File name:STP09876546700-098765..PDF..exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:611'487 bytes
First seen:2022-10-03 06:59:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (388 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 12288:eToPWBv/cpGrU3yDgw5GNwQjM70BVvKy9GktNBT4:eTbBv5rU8v5GNfg70B1ZBU
Threatray 2'847 similar samples on MalwareBazaar
TLSH T1CAD4E00279C294B2D0A239F61A75A711A9397D600B69C9CFA3F43E1CD9711C3DE317AE
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 174f4559191b1b13 (81 x AgentTesla, 68 x Formbook, 34 x SnakeKeylogger)
Reporter adrian__luca
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315949/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Unauthorized injection to a recently created process by context flags manipulation
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40774/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/633a8893c9e2f343543258b8/reports/b8c1c082-c113-440c-9b23-b50c7e31d7e7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/dccb4555-8a81-45a4-980c-5c80e094d85e
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1082181
Signature
Antivirus detection for dropped file
Found hidden mapped module (file has been removed from disk)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Yara detected Generic Downloader
Yara detected Generic Dropper
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-09-29 11:29:50 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2vhlygpjq35r7pnwvyz674pmn5s7tongxob5dybzkrjgg6jbptiq._file
Verdict:
malicious
Similar samples:
0c22e8ea0ba6fc4f77bd273a12dd319e991899499b4bea8422d146d447034505
SnakeKeylogger
301a3e665000c99ab655a74dbf9408de24875866528be4f6d28e83490c19305b
SnakeKeylogger
339539d03ce22693c391b3141e6c20b2403da4efe6e25247c87c81a2e2fe1530
SnakeKeylogger
467ad63f6a1235c46806e9da0af33d358e0428c50e8419de415948db720e56ee
SnakeKeylogger
6bcf5705424ff9935c6dfd886e666af3cb2da930cfe82b0924b599f682b8f9bf
SnakeKeylogger
ce349034ea5373d13d5fa3adaf34a3ecffff799fe9044d4a2c98bd8a16f0e9ed
SnakeKeylogger
f56bd344f2e9650ba6def3340bc5ac26472ea615744b38786d5445a75a0e51b4
SnakeKeylogger
+ 2'837 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221003-hsnvdscdb6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Gathering data
Unpacked files
SH256 hash:
6ffc9b4e7897bf9b477355154d800091c8e225ab5928fd0935f31b83e367b530
MD5 hash:
d69438dcad59bfa694a0faf1d11cd0c9
SHA1 hash:
c1d3bf05ad948f9a2667b6fa08e0cae0e4220c9b
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/bcd7749e-aee1-4b2e-a434-8851e61f1789/
Parent samples :
339539d03ce22693c391b3141e6c20b2403da4efe6e25247c87c81a2e2fe1530
fd34c505f68158cc8090e0e0ea5d3ece3df792c6ec3a7648ec484a5cafee5600
26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6
d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1
SH256 hash:
f5421ad34a0328fc14146058f4059b64deea2fda38c77416f1770c3794061f27
MD5 hash:
0e5a933f8e64bbf268d05cd9110ef6a1
SHA1 hash:
a979f34e2c916fe19d9b909d43005358e6ef6686
Detections:
win_mofksys_auto
Create hunting rule
Link:
https://www.unpac.me/results/bcd7749e-aee1-4b2e-a434-8851e61f1789/
Parent samples :
26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6
d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1
dcf5a9ee29889bc50645eb2cc01e1d0449550d9757e200ae8cd86b175d87ab1e
162e62a5fdd086d5d83c8d7cf95361fa0592c457b421e170bc00b525b7691bfc
4815c4b0a11e7bd4bac2db7bff612905804f5ec2272a6c299f842f572572f135
SH256 hash:
d1089841ba4b87bb91c79ef7d089a97a92bbcea2a0f80afbf4384a34ab2546d2
MD5 hash:
0f6fa6e4fad55801cdafba1046dce910
SHA1 hash:
50fff2bdcd5c9524061d49d0faf040d19416771d
Link:
https://www.unpac.me/results/bcd7749e-aee1-4b2e-a434-8851e61f1789/
SH256 hash:
d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1
MD5 hash:
2bff9d309fb2e73e5228937a4838dd79
SHA1 hash:
946d162631de9d4a9cca53f22c600abedd226230
Link:
https://www.unpac.me/results/bcd7749e-aee1-4b2e-a434-8851e61f1789/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d54ebc19e986/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RansomwareTest8
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe d54ebc19e986fb1fbdb6ae33eff1ec6f65f9b9a6bb83d1e03954526379217cd1

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/315949/

Comments