MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df9b84872634e5a1c45ed710b2190f5ddbcf8672d4debea177c8b276347d2bec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df9b84872634e5a1c45ed710b2190f5ddbcf8672d4debea177c8b276347d2bec
SHA3-384 hash: 3d8cd1baa1edb4e5a8b8f407c722d6af5118530a538e4bc896443e47cd843357c090b16730106eaecc4a35121b4ea662
SHA1 hash: 3855031742283d760e4e2bb43834b99070f681d0
MD5 hash: 65edda1dcd13a0b832c45ffcd0ace852
humanhash: bakerloo-one-william-william
File name:swift copy remittance.iso
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:620'544 bytes
First seen:2021-05-20 05:29:51 UTC
Last seen:2021-05-20 06:12:32 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Czg0vdEKotXzDOMfj4R9+CmWJgQIwN/L+ijRoXhVwSQT6AuzS+UgeRXMJj6ID0Ni:Cwe3A6zfubaYrR2hBbyn+ma/
TLSH 7FD4DF2333D89B61E0BDA7755022541043F3B546E736EA9C7EAC449C6763FC886B2B93
Reporter fabjer
Tags:iso SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.747-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df9b84872634e5a1c45ed710b2190f5ddbcf8672d4debea177c8b276347d2bec/
Threat name:
Win32.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-05-20 05:30:20 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=36nyjbzggts2drc624ilegiplxn47bts2tpl5ilxzczhmnd5fpwa._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210520-jv79qjhvd2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot1652586889:AAH8lHbzvtT4QjX1_-3uSZQlT1RC65TAqMU/sendMessage?chat_id=1661687416
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/df9b84872634e5a1c45ed710b2190f5ddbcf8672d4debea177c8b276347d2bec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso df9b84872634e5a1c45ed710b2190f5ddbcf8672d4debea177c8b276347d2bec

(this sample)

SnakeKeylogger

Executable exe 49b0abe332a386c4524d4a5a41e4ca43768e0416d7f3edfc47503314ad1ffc8c

  
Dropping
SHA256 49b0abe332a386c4524d4a5a41e4ca43768e0416d7f3edfc47503314ad1ffc8c
  
Delivery method
Distributed via e-mail attachment

Comments