MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db8ae92feb34e825ebfae00f75e27bbb5cb914533f45cc11799fc4d96f93e69a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	db8ae92feb34e825ebfae00f75e27bbb5cb914533f45cc11799fc4d96f93e69a
SHA3-384 hash:	a5cb9c69ac3f8ed4e2371625788b39271f043ba95b66bc2eeeafc5ebdbaae7478679f26abb1d0f062f5778e4f6d936ed
SHA1 hash:	e392f710bb523b493475b889df57e3cb1d18cb32
MD5 hash:	044de8acb8b415cf3ba5ce8d33471bf5
humanhash:	maryland-oven-angel-lithium
File name:	Minutes Of Meeting.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	1'044'992 bytes
First seen:	2021-06-18 05:47:46 UTC
Last seen:	2021-06-18 21:05:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:jfhlm4S4F3M9ywSMPQipP599kR36yxAP8K+Kiwiaz4M4TRYgbmpPCBPqZ32+Kv:j5Wwip6RqqAkneTklX8WqZ3tK
Threatray	395 similar samples on MalwareBazaar
TLSH	7C25AF221ECF422AE2764FB55BB0BC87C276AD663705E2153DC0329DCA335D9C8DE526
Reporter	cocaman
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Minutes Of Meeting.exe

Verdict:

Malicious activity

Analysis date:

2021-06-18 05:51:19 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/aaaf129f-0773-43a8-bc62-e601299f6c5d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/166725/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.851.31630.24543.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

njRAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b5947cca-293b-44ae-b844-2594f3c96e27

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/804102

Signature

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected AntiVM3

Yara detected Beds Obfuscator

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db8ae92feb34e825ebfae00f75e27bbb5cb914533f45cc11799fc4d96f93e69a/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-06-17 15:51:41 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 29 (62.07%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ofosl7lgtucl2724ahxlyt3xnolsfcth5c4yelzt7cns34t42na._file

Verdict:

unknown

SnakeKeylogger

59653f2c5630242b3d29eece0a082cb9bcf2a81fed170e3c9a2cbfc50ade86d3

SnakeKeylogger

80104e0ad490b44a632a15e5875e7626db7f35fa94d7aadf19c45a621d75c7e0

SnakeKeylogger

8f56dac579673096203818fcc9fd96e120a82b697539e6da59558d57d8ba96cb

SnakeKeylogger

903de95a30d55eaf9ecb49a0a310df96c215b51b25b3d3e8628adae14a94e7f0

SnakeKeylogger

9cf0ad120d6b3b0c632047d9963328e6afd535786a89108df10c6e8777c14531

SnakeKeylogger

b637168bfa7520b4317e7c0b3f671c339a54b8cc37e5f7348aee8a40fa32239a

SnakeKeylogger

c831c5bd72fe678827448b378fb51fe9a9445642579a39bbe8f36ed55b1441f6

SnakeKeylogger

e463978735f615b42931f614c058f5596e21a50fbb226bb235c038c2a1e129e2

SnakeKeylogger

ed5763662cab2ac5ba8c629f7962bafce36798a1eb84c5859cf57a4c27b413ee

SnakeKeylogger

+ 385 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210618-extatkcds6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger Payload

Unpacked files

SH256 hash:

1b44bfc846a2f6f28752c6a0bd81495d9ca0015c4f2b742c8019c593b237f570

MD5 hash:

4f7045ac4d366a4297780f277d1a544e

SHA1 hash:

dab13fee3fd6d5df3b080ca5bd4acac5eabef28f

Link:

https://www.unpac.me/results/db4a6681-9ee6-44de-a128-d2c569b361a1/

SH256 hash:

db8ae92feb34e825ebfae00f75e27bbb5cb914533f45cc11799fc4d96f93e69a

MD5 hash:

044de8acb8b415cf3ba5ce8d33471bf5

SHA1 hash:

e392f710bb523b493475b889df57e3cb1d18cb32

Link:

https://www.unpac.me/results/db4a6681-9ee6-44de-a128-d2c569b361a1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/db8ae92feb34e825ebfae00f75e27bbb5cb914533f45cc11799fc4d96f93e69a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.