MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f
SHA3-384 hash: e8a09d31015a380ac82caa3a529d854cc3a5e6ca4921944a7a8097e5f096d67c83b305364ac804aef01c546663da0693
SHA1 hash: 85abea2166fb57e429c65e72000d119045b137f1
MD5 hash: 28619e1118e9490f788b48249f9a5e45
humanhash: enemy-indigo-ten-india
File name:CT-0000337_PROTECH DEL PEREU SAC.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:767'488 bytes
First seen:2021-02-09 18:54:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ftxPqiq40OqWqOq9EJT5M/TP5J7S1cupUZFMdce25nUhCSbt/fqt+XwwA1lm/FOe:DJe7PP0pUZit+UffdgfU8McW5Lwfe
Threatray 7 similar samples on MalwareBazaar
TLSH 5BF49D5623486F1BE1BDB3B9D0650870A3F5EE12E315EB8F3EAA31CE0675F44D616602
Reporter abuse_ch
Tags:exe Hostwinds SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hwsrv-830423.hostwindsdns.com
Sending IP: 104.168.219.169
From: Ericka Marquez <ap@rtisafeco.pw>
Subject: SOLICITUD DE COTIZACION
Attachment: CT-0000337_PROTECH DEL PEREU SAC.cab (contains "CT-0000337_PROTECH DEL PEREU SAC.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8.exe
Verdict:
Malicious activity
Analysis date:
2021-02-09 14:37:12 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/a07298af-5791-4381-ac1c-941eab747567

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/116232/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.537.23067.20175.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/603475
Signature
.NET source code contains potential unpacker
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 16:38:54 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22iv7tkrihqrwzh5rm4rw2n6qon4h7puz2gsn3sasp7kvb34ea7q._file
Verdict:
unknown
Similar samples:
246e9697008fce6c7466e6e1abd6bd8065b2757792116b8384081b8435f0db85
SnakeKeylogger
756b62870ec4d9a47422a73e78ae0021ede54b1399c93dbb3f014badb82b9905
SnakeKeylogger
91d45d4558b4f934e758ab759f27abaa8f98c1b346fca94032a4fc86bfad2974
SnakeKeylogger
bb565cb82988981590cf413b076eb8c1a95ae230079df273f00151f1e56edc24
SnakeKeylogger
d07b6dc5e5cebc0e6a10ab830a009ced0290b79bf1243c7254e585021ea7275d
SnakeKeylogger
db33d1e7f7eefff11196927bca2e400e4950e3d78316cd17d220b85ce00dd465
SnakeKeylogger
e28462a26e523bc5c38aea7d6a0d5da590e1672904e78f70cb5b65d488cfb774
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger ransomware spyware stealer
Link:
https://tria.ge/reports/210209-eahrvjyjh6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
6f9ed402e7cc55b01572bb0f00521f0cc9b786c7942e4fc89ab8090dadfdbc22
MD5 hash:
cdc2d630b3064bf102abc40fa48c6dbf
SHA1 hash:
9a0014e32d9921b1a2ee64b4e2515cae255f656a
Link:
https://www.unpac.me/results/58535a9e-fd3e-4e43-a9f7-2132f80805de/
SH256 hash:
630d0666317c6044871a4bbcbcf40c576b06bc0bec0e073d69ad97f716c80ac2
MD5 hash:
344ff6c7aa760159398609e666103444
SHA1 hash:
77de4238ff38e3b54074e8758642dfd6ef812476
Link:
https://www.unpac.me/results/58535a9e-fd3e-4e43-a9f7-2132f80805de/
SH256 hash:
e885728025587b6aea5728638cbc8b5304453e441f495a0877eeaf8aae0fe237
MD5 hash:
8a6baba093de32f47138087187bca7f0
SHA1 hash:
003a7cb9f7b62969f29ed96dc20404e1ea4d0074
Link:
https://www.unpac.me/results/58535a9e-fd3e-4e43-a9f7-2132f80805de/
SH256 hash:
d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f
MD5 hash:
28619e1118e9490f788b48249f9a5e45
SHA1 hash:
85abea2166fb57e429c65e72000d119045b137f1
Link:
https://www.unpac.me/results/58535a9e-fd3e-4e43-a9f7-2132f80805de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

cab b548185ab35b24223d97e764b4f71c4a2e2cf2156f1652cf2cc482ca73b93f18

SnakeKeylogger

Executable exe d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f

(this sample)

  
Dropped by
MD5 888699dd46f8660a4f334539a1eb897f
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b548185ab35b24223d97e764b4f71c4a2e2cf2156f1652cf2cc482ca73b93f18
Cape
Cape
https://www.capesandbox.com/analysis/116232/

Comments