MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6
SHA3-384 hash: 3f743d31dc7769f49148f46c5ae705dbdda2ff9219b159cb07add1fc2884ae9719bb61830a6e1222010c59ced7f0832a
SHA1 hash: cd6a7f7ac3bcdcf9dcaf95235169a5c705559f04
MD5 hash: c6f8afa65badddd3590c98f05c766c01
humanhash: hydrogen-quebec-golf-victor
File name:c6f8afa65badddd3590c98f05c766c01.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:507'904 bytes
First seen:2023-09-20 08:40:06 UTC
Last seen:2023-09-20 10:32:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:+0K7h3BwuJAK2lVWCG7FyODeqBRBCre9GFxenN97uKk:kbJWXEd6mBt0FxWRk
Threatray 213 similar samples on MalwareBazaar
TLSH T1D8B412183BB4DD83D46C5BB90430028167B2CD5AFD26D7A8BCCAB1E60667F61C61678F
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 886443434b83cbe2 (17 x AgentTesla, 7 x Formbook, 4 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
285
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c6f8afa65badddd3590c98f05c766c01.exe
Verdict:
Malicious activity
Analysis date:
2023-09-20 08:44:31 UTC
Tags:
snake
Link:
https://app.any.run/tasks/2bc5fa61-348c-409c-84ec-b1a42955e662

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/449975/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.27388.28531.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650ab01f83a0c6425dfa358a/reports/fc0f7d9b-5cdf-46b7-9a5c-66b3b67a0311/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5dc4c230-8d1f-4dfd-972a-8a0eb37fe691
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1311424
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Changes security center settings (notifications, updates, antivirus, firewall)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1311424 Sample: Os5z74oBQS.exe Startdate: 20/09/2023 Architecture: WINDOWS Score: 100 45 checkip.dyndns.org 2->45 47 checkip.dyndns.com 2->47 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Sigma detected: Scheduled temp file as task from temp location 2->55 57 9 other signatures 2->57 9 Os5z74oBQS.exe 7 2->9         started        13 pbBJjdqAz.exe 5 2->13         started        signatures3 process4 file5 41 C:\Users\user\AppData\Roaming\pbBJjdqAz.exe, PE32 9->41 dropped 43 C:\Users\user\AppData\Local\...\tmpAB0B.tmp, XML 9->43 dropped 59 Uses schtasks.exe or at.exe to add and modify task schedules 9->59 61 Adds a directory exclusion to Windows Defender 9->61 63 Injects a PE file into a foreign processes 9->63 15 svchost.exe 9->15         started        18 Os5z74oBQS.exe 15 2 9->18         started        21 powershell.exe 23 9->21         started        29 2 other processes 9->29 65 Multi AV Scanner detection for dropped file 13->65 67 Machine Learning detection for dropped file 13->67 23 pbBJjdqAz.exe 14 2 13->23         started        25 schtasks.exe 1 13->25         started        27 pbBJjdqAz.exe 13->27         started        signatures6 process7 dnsIp8 69 Changes security center settings (notifications, updates, antivirus, firewall) 15->69 31 MpCmdRun.exe 15->31         started        49 checkip.dyndns.com 158.101.44.242, 49694, 49695, 80 ORACLE-BMC-31898US United States 18->49 33 conhost.exe 21->33         started        71 Tries to steal Mail credentials (via file / registry access) 23->71 73 Tries to harvest and steal browser information (history, passwords, etc) 23->73 35 conhost.exe 25->35         started        37 conhost.exe 29->37         started        signatures9 process10 process11 39 conhost.exe 31->39         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-20 08:41:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=27qaag24rzm4o7kpjtcgpbdutd3xktlec7t5xvmstcppopmqyxta._file
Verdict:
malicious
Similar samples:
00ac19ff4d74e87b2171112c99d65fa386850b1be0b73bafac4dda96e28b2c53
SnakeKeylogger
2ba5d8e1c77dac550fd1b7d19174670a30da616780dbad4d386f6b9dc2121e9c
SnakeKeylogger
38e497ba967a7027611f38d868b02f7c00405cc0cde0500ee32a61103dddd4f4
SnakeKeylogger
75928078ee7371de911070ffee3d0eb2abe327490006ae659534672827a19681
SnakeKeylogger
76c0e4a0502324db78e70bd3b307ecb20405ee15c7321b1d6175b7d5b0701b1e
SnakeKeylogger
80c0c7648149fdb4b41f5abc6316de36da5c3133676d4c9d68e783ba70cb46c0
SnakeKeylogger
b9bca44f6e2224f28b36f94303b45cfca4270c60ec0ba099cfb58e3d677457f7
SnakeKeylogger
e4b46a390ed3597681b12b1834985a5a8ddaf4cae96ff14ed8c2ed0d1784c11c
SnakeKeylogger
f1ea8c37671f60ae1dde6ef3ad770e623eedc7a2c06eda822708533b52f2c2bd
SnakeKeylogger
+ 203 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230920-klez1shc39/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6316392918:AAHcjKTVDupG6SMH3LkXAeVBgHKlqsAcmRU/sendMessage?chat_id=6445748530
Unpacked files
SH256 hash:
b58e8f44c16e052c300e324d8d31929900420e527ee85eb4748251978ebe1a37
MD5 hash:
80e8120e0d74beaa8f70b44e00c66be6
SHA1 hash:
d00b435e8bb6402a2ce5775ef14cfc72e4964f4b
Link:
https://www.unpac.me/results/c7386bb7-8298-4a4c-8580-8d3f8058afb4/
SH256 hash:
1776503c0565800d08b124cca72fac57312708f32b6485b150be454c4a998743
MD5 hash:
5943ea602c94fef3a67c478ddcce460b
SHA1 hash:
84d9221a7fc22f6ccf84087529e00ce44421e743
Link:
https://www.unpac.me/results/c7386bb7-8298-4a4c-8580-8d3f8058afb4/
SH256 hash:
7c381aa21265e230ee872afa0d7374024ca82f17030a6dda5514ab21d9cf0b4b
MD5 hash:
00beaf0b10d9ea32a8857efbdaa9cf55
SHA1 hash:
4c0e6ce8bf3afe2db364d5fcbe83c41e44d58a52
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/c7386bb7-8298-4a4c-8580-8d3f8058afb4/
Parent samples :
d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6
f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12
SH256 hash:
f81eaa1abe14620a12d66f2906fb74536570f579489befc12d985b2483d17ff8
MD5 hash:
6a1985480d88415dab4af9e77965933d
SHA1 hash:
36ac47cd70012c3057281fed60665f59cdacf28c
Link:
https://www.unpac.me/results/c7386bb7-8298-4a4c-8580-8d3f8058afb4/
SH256 hash:
d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6
MD5 hash:
c6f8afa65badddd3590c98f05c766c01
SHA1 hash:
cd6a7f7ac3bcdcf9dcaf95235169a5c705559f04
Link:
https://www.unpac.me/results/c7386bb7-8298-4a4c-8580-8d3f8058afb4/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d7e0001b5c8e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

Executable exe d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2712649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/449975/

Comments