MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8496d072e29b2cfdeda1988750626b8ab6a1c587c3d91396cdad272d9217546. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8496d072e29b2cfdeda1988750626b8ab6a1c587c3d91396cdad272d9217546
SHA3-384 hash: b9051ac2ecfee1b43b920ce60aee307d687a1be2fe7ab992bd47a749ece49fc11e3958285e64ac91270c9ca27f27445f
SHA1 hash: 9d3a8ba7861c06881ef63929f841e1452500163e
MD5 hash: d7328ec415afead8ac14fdb4b9645c1b
humanhash: maine-leopard-juliet-texas
File name:TER.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:823'296 bytes
First seen:2021-08-18 23:50:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:fgZDc9F3nC0Py3gAhtUXXXjHeEdZzC6cUbC7VpJixVSiykgFrvBi7nV:fqUTHeEdp3cXriy1YV
Threatray 769 similar samples on MalwareBazaar
TLSH T14105C4BC19B9B62791B9C765EBE18817F0409C9F3151AC64E4EE27B7032EA5234C723D
Reporter AndreGironda
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TER.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-18 23:51:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/66055164-7b2c-41ca-9aee-f6c57079d8f6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.998-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a4b0c74-b604-4904-8a8e-6f33826630f4
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/835435
Signature
.NET source code contains very large strings
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 467866 Sample: TER.exe Startdate: 19/08/2021 Architecture: WINDOWS Score: 100 27 Found malware configuration 2->27 29 Malicious sample detected (through community Yara rule) 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 8 other signatures 2->33 7 TER.exe 4 2->7         started        process3 file4 23 C:\Users\user\AppData\Local\...\TER.exe.log, ASCII 7->23 dropped 35 Adds a directory exclusion to Windows Defender 7->35 37 Injects a PE file into a foreign processes 7->37 11 TER.exe 2 7->11         started        13 powershell.exe 23 7->13         started        signatures5 process6 process7 15 dw20.exe 22 6 11->15         started        19 conhost.exe 13->19         started        dnsIp8 25 192.168.2.1 unknown unknown 15->25 21 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 15->21 dropped file9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8496d072e29b2cfdeda1988750626b8ab6a1c587c3d91396cdad272d9217546/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 19:21:33 UTC
AV detection:
26 of 47 (55.32%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
026329441e24cadc514a9b5917f1d4a932b94c9e41cf6deb51f270cb8f483144
SnakeKeylogger
185b0943e47ff2499a805f751a20dfd58ef018e9e20f170a51cfd9d009992803
SnakeKeylogger
252225cfd4ec7a7b61e5138d1587a4a212909f596004b8a157fe9f0ed4c6496b
SnakeKeylogger
3135c2d82800dca37b92f19b2cf806f7a4f06be85f3bc07cf46f4bfd78fca710
SnakeKeylogger
98f8f5b4344359c18ff220770c9baaf083af1436d65e361787760bd902d93c9f
SnakeKeylogger
9ff44ba44707bbdda0a858a2d0c11725b146fb4671ed91295ce2e0a3ac8b175c
SnakeKeylogger
d57a5e8835ba746d89d2c4ecc9f904793b485c6affc1b9901486c84eb88f4e1e
SnakeKeylogger
+ 759 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210818-5cby9rpnl2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Snake Keylogger
Unpacked files
SH256 hash:
b36bf1be6b125c8e4a5e8b2ba667482b86e95a96bea4ba578a2b696315362c72
MD5 hash:
79cc2d1b425e99753767be50b1dea322
SHA1 hash:
9b8995c9d6ba293711f993e166056ed855b1819f
Link:
https://www.unpac.me/results/f0e2866b-20e1-44c5-a5fe-d51fa1f79861/
SH256 hash:
6912e4bedd1288f116e968f0a79d9797f6d6bd24d45a5f10c52e20f9d33b8c61
MD5 hash:
03bde4a82ad64c0f314985232fbca3fa
SHA1 hash:
e8d0b6339e94192eaaca32c812f914e60576dca6
Link:
https://www.unpac.me/results/f0e2866b-20e1-44c5-a5fe-d51fa1f79861/
SH256 hash:
5f639b4a240920f11494f377af1d51abba438a344400eeef4dbb8327649306f1
MD5 hash:
59dc8075fc2f0f74a3646d806719d6a4
SHA1 hash:
f53b8722c40632a642d478514b00b90cd8ccecbb
Link:
https://www.unpac.me/results/f0e2866b-20e1-44c5-a5fe-d51fa1f79861/
SH256 hash:
d8496d072e29b2cfdeda1988750626b8ab6a1c587c3d91396cdad272d9217546
MD5 hash:
d7328ec415afead8ac14fdb4b9645c1b
SHA1 hash:
9d3a8ba7861c06881ef63929f841e1452500163e
Link:
https://www.unpac.me/results/f0e2866b-20e1-44c5-a5fe-d51fa1f79861/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8496d072e29b2cfdeda1988750626b8ab6a1c587c3d91396cdad272d9217546

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

SnakeKeylogger

Excel file xlsx 085b09c0ae15f2f4b306ead056a6cadd45a6e66a776776d9a01d04c57cdcfcce

SnakeKeylogger

Executable exe d8496d072e29b2cfdeda1988750626b8ab6a1c587c3d91396cdad272d9217546

(this sample)

5f639b4a240920f11494f377af1d51abba438a344400eeef4dbb8327649306f1

Cape
Cape
https://capesandbox.com/analysis/180384/
  
Link
https://tria.ge/210818-atckpbkvpe
  
Dropped by
SHA256 085b09c0ae15f2f4b306ead056a6cadd45a6e66a776776d9a01d04c57cdcfcce
  
Dropping
SHA256 5f639b4a240920f11494f377af1d51abba438a344400eeef4dbb8327649306f1
  
Dropping
SHA256 6912e4bedd1288f116e968f0a79d9797f6d6bd24d45a5f10c52e20f9d33b8c61
  
Dropping
SHA256 b36bf1be6b125c8e4a5e8b2ba667482b86e95a96bea4ba578a2b696315362c72
  
Dropping
SHA256 b47d21b6457f499b09ed73ce8cc7bc910abbb6f9aa37458f58c32095a1955713
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1544960/

Comments