MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d6af4d738cb8ae43f17b65cd5799224b68a8691b7d3a6cd21543d39012b1def8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 15
| SHA256 hash: | d6af4d738cb8ae43f17b65cd5799224b68a8691b7d3a6cd21543d39012b1def8 |
|---|---|
| SHA3-384 hash: | 17b6690225c6951ca814280a347b66590622511744a4079cc6e00870ed78318798eb1aa2ec9713c2d2b717ad08d4226f |
| SHA1 hash: | aad6ef9d9cc84aaf91b1dc7a19707ae4870d0754 |
| MD5 hash: | 247980e6c8b5be662554a0ece7efc762 |
| humanhash: | north-maryland-football-mockingbird |
| File name: | 247980e6c8b5be662554a0ece7efc762 |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 750'592 bytes |
| First seen: | 2023-02-07 09:34:31 UTC |
| Last seen: | 2023-08-25 17:26:44 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:XpkfPAEcXnyXx6q15dGy2jagh0jwL50s/PZr48hoPvqcQ3lIg9gahRZ5GX:UAE1NoyQCjw9jP9Jhsq7iS5G |
| Threatray | 10'387 similar samples on MalwareBazaar |
| TLSH | T190F422013369C660C87ECDF1FB787994137D6316A922DA6C8EFCA5CBE62172DD860253 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 8200828086860000 (9 x AgentTesla, 5 x SnakeKeylogger, 4 x Formbook) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
3
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
WSM-PCS 17633.doc
Verdict:
Malicious activity
Analysis date:
2023-02-07 08:37:21 UTC
Tags:
exploit cve-2017-11882 loader evasion trojan snake keylogger
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Forced shutdown of a browser
Verdict:
No Threat
Threat level:
2/10
Confidence:
67%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-02-07 04:12:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 10'377 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
a0facae0a030a59b239723848bad4a29358ed7643c27adeaeb9c84906c20b73f
MD5 hash:
e5eae460107fcfae972e644ea6817d62
SHA1 hash:
f78a35957fe7eec6818a86ae9959bdb72ee0d9f8
SH256 hash:
6384dabeffdc0afc3d7f1e18d0033e7482790c0aa2f1f2af7cc39eb81795d0ef
MD5 hash:
f759d70f3bbee3865d9ba45b70c59bea
SHA1 hash:
f07ca29866cf8b0d92f18904860c40a284a5f550
SH256 hash:
d06c234f275c8711a0fd97626d24880f2cf898fbe994d26aa1e0a80c7b0c29be
MD5 hash:
046df19971d8e042fe9c24b65500f127
SHA1 hash:
291298ba63fd26e86c1a1032f83e6d5d40b38d2c
Detections:
snake_keylogger
SH256 hash:
6c3478443c217c93d57f9b7c75f70bdf53ac58cea5a12f6790180841cbbcda85
MD5 hash:
18509ede94e5148d3b394fd312d75508
SHA1 hash:
182ef96dde669885c88c6c3747d12e0bb9b6fac3
SH256 hash:
8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c
MD5 hash:
e5b073b30db1b058298f5df032164e4d
SHA1 hash:
15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca
SH256 hash:
d6af4d738cb8ae43f17b65cd5799224b68a8691b7d3a6cd21543d39012b1def8
MD5 hash:
247980e6c8b5be662554a0ece7efc762
SHA1 hash:
aad6ef9d9cc84aaf91b1dc7a19707ae4870d0754
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://208.67.105.179/teenfroshzx.exe