MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a
SHA3-384 hash: 5bddeed51c261af7c863d17e38073200ad93247db03213c764ed633cffbcac820c9eda704aeb8b4650c18e41b9b839a7
SHA1 hash: 6a35a5fa5a53ceba217c66562477e954aec8eb2b
MD5 hash: 40c32c129e09d3eb618e27eb168aaadf
humanhash: beer-april-oklahoma-low
File name:qbOdWSNNuqquo2E.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:2'088'448 bytes
First seen:2023-04-04 08:39:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 332f7ce65ead0adfb3d35147033aabe9 (82 x XRed, 18 x SnakeKeylogger, 7 x DarkComet)
ssdeep 49152:6nsHyjtk2MYC5GDDMZEf4F0fVGJ2LxsL9ve049:6nsmtk2a1igSA2F0DU
Threatray 57 similar samples on MalwareBazaar
TLSH T1D6A5E133F2D18537D1321B3D9C5BA399593ABE512D38B94A3BE91E4C4E3E38128652D3
TrID 87.6% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
5.6% (.EXE) InstallShield setup (43053/19/16)
1.8% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.EXE) Win64 Executable (generic) (10523/12/4)
1.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
dhash icon e0c4cee0e1c2a0e0 (1 x SnakeKeylogger)
Reporter pr0xylife
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
qbOdWSNNuqquo2E.exe
Verdict:
Malicious activity
Analysis date:
2023-04-04 08:40:26 UTC
Tags:
installer snake keylogger trojan evasion
Link:
https://app.any.run/tasks/99de6280-dd65-4b70-8b60-9c9592067601

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/379913/
Detection(s):
PUA.Win.Packer.D1s1g-5
Create hunting rule

PUA.Win.Packer.D1s1g-2
Create hunting rule

PUA.Win.Packer.D1s1g-1
Create hunting rule

Win.Trojan.Emotet-9850453-0
Create hunting rule

Win.Trojan.Generic-9936029-0
Create hunting rule

Win.Malware.Delf-6899401-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Moving a recently created file
Searching for the window
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Modifying an executable file
DNS request
Sending an HTTP GET request
Sending a UDP request
Sending a custom TCP request
Creating a process with a hidden window
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/76461/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd.exe darkkomet evasive fingerprint greyware hacktool keylogger macros macros-on-close macros-on-open packed shell32.dll
Link:
https://www.filescan.io/uploads/642be265cda03520c8a59a02/reports/d6d88133-a025-4904-a350-a971835661b6/overview
Verdict:
Malicious
Labled as:
Delf.NBX virus
Link:
https://www.hybrid-analysis.com/sample/e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f6b44119-9d7b-45ba-adc4-a11798f9df20
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
expl.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1207863
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Drops PE files to the document folder of the user
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 840779 Sample: qbOdWSNNuqquo2E.exe Startdate: 04/04/2023 Architecture: WINDOWS Score: 100 114 Snort IDS alert for network traffic 2->114 116 Malicious sample detected (through community Yara rule) 2->116 118 Antivirus detection for dropped file 2->118 120 15 other signatures 2->120 8 qbOdWSNNuqquo2E.exe 1 6 2->8         started        11 bRBgyCtm.exe 2->11         started        14 EXCEL.EXE 23 19 2->14         started        16 4 other processes 2->16 process3 file4 72 C:\Users\user\...\._cache_qbOdWSNNuqquo2E.exe, PE32 8->72 dropped 74 C:\ProgramData\Synaptics\Synaptics.exe, PE32 8->74 dropped 76 C:\ProgramData\Synaptics\RCX4F63.tmp, PE32 8->76 dropped 78 C:\...\Synaptics.exe:Zone.Identifier, ASCII 8->78 dropped 18 ._cache_qbOdWSNNuqquo2E.exe 6 8->18         started        22 Synaptics.exe 132 8->22         started        142 Machine Learning detection for dropped file 11->142 25 bRBgyCtm.exe 11->25         started        27 schtasks.exe 11->27         started        signatures5 process6 dnsIp7 62 C:\Users\user\AppData\Roaming\bRBgyCtm.exe, PE32 18->62 dropped 64 C:\Users\user\AppData\Local\...\tmp552B.tmp, XML 18->64 dropped 66 C:\Users\...\._cache_qbOdWSNNuqquo2E.exe.log, ASCII 18->66 dropped 122 Machine Learning detection for dropped file 18->122 124 Uses schtasks.exe or at.exe to add and modify task schedules 18->124 126 Adds a directory exclusion to Windows Defender 18->126 29 ._cache_qbOdWSNNuqquo2E.exe 18->29         started        32 powershell.exe 21 18->32         started        34 schtasks.exe 18->34         started        46 3 other processes 18->46 88 docs.google.com 142.251.36.206, 443, 49692, 49693 GOOGLEUS United States 22->88 90 freedns.afraid.org 69.42.215.252, 49697, 49921, 80 AWKNET-LLCUS United States 22->90 92 xred.mooo.com 22->92 68 C:\Users\user\Documents\HMPPSXQPQV\~$cache1, PE32 22->68 dropped 128 Antivirus detection for dropped file 22->128 130 Multi AV Scanner detection for dropped file 22->130 132 Drops PE files to the document folder of the user 22->132 36 WerFault.exe 22->36         started        94 192.168.2.1 unknown unknown 25->94 70 C:\Users\user\...\._cache_bRBgyCtm.exe, PE32 25->70 dropped 38 ._cache_bRBgyCtm.exe 25->38         started        42 Synaptics.exe 25->42         started        44 conhost.exe 27->44         started        file8 signatures9 process10 dnsIp11 80 C:\...\._cache_._cache_qbOdWSNNuqquo2E.exe, PE32 29->80 dropped 48 ._cache_._cache_qbOdWSNNuqquo2E.exe 29->48         started        52 conhost.exe 32->52         started        54 conhost.exe 34->54         started        96 checkip.dyndns.org 38->96 98 checkip.dyndns.com 38->98 134 Antivirus detection for dropped file 38->134 136 May check the online IP address of the machine 38->136 138 Tries to steal Mail credentials (via file / registry access) 38->138 140 3 other signatures 38->140 100 xred.mooo.com 42->100 102 freedns.afraid.org 42->102 104 docs.google.com 42->104 82 C:\Users\user\Documents\~$cache1, PE32 42->82 dropped 56 WerFault.exe 42->56         started        58 WerFault.exe 42->58         started        60 WerFault.exe 42->60         started        file12 signatures13 process14 dnsIp15 84 checkip.dyndns.com 193.122.130.0, 49904, 49915, 80 ORACLE-BMC-31898US United States 48->84 86 checkip.dyndns.org 48->86 106 Antivirus detection for dropped file 48->106 108 May check the online IP address of the machine 48->108 110 Tries to steal Mail credentials (via file / registry access) 48->110 112 Machine Learning detection for dropped file 48->112 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a/
Threat name:
Win32.Virus.Napwhich
Create hunting rule
Status:
Malicious
First seen:
2023-04-04 07:34:29 UTC
File Type:
PE (Exe)
Extracted files:
75
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4cpkvjyheylvn4zczdk3ckxqucofox733v57dg4jlsvutavx62fa._file
Verdict:
malicious
Similar samples:
012cedcd51898228db8bf8b1acfc84fdac3bfcee0fbc5be1acc1dc66b95a15d2
SnakeKeylogger
1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180
SnakeKeylogger
9360554f2e28415c1060e32aed40757998e0b16db0905f4ae5e1d21676b00ec5
SnakeKeylogger
a75a4275af774a29509c461049253572a3181351736db3d1234a31ed3d4ab260
SnakeKeylogger
d3cf4b037c360479189571116894759683426af15cf85197f7e7dc9c180f7963
SnakeKeylogger
d6e217e6d822b7db300fbd2df88de22ba5826a9b977b317904abdd40376cf54b
SnakeKeylogger
d7c3bb09aa5e1d92564315ab491476d795850f7503dbad7e2835a87c7904d5b2
SnakeKeylogger
dc89fb6fea674bafdb5f7945ece7ba57090647996caee4fd06e7f2a4c20fe4ea
SnakeKeylogger
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
SnakeKeylogger
+ 47 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/230404-kkvzvaff7y/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6241220793:AAFx6XFOw5z4Op7twC8hAqYib_mTz67Z4Ak/sendMessage?chat_id=2054148913
Unpacked files
SH256 hash:
ec20bb2cbb58ecec077f62b366079bc73cb5c0d52d7bcfe72a8f11b47f533226
MD5 hash:
564d7c8847feac6d94fdcd1cb9aa5b5e
SHA1 hash:
ec180922fbe20ff2f08f67f3bf0021d13d970f2a
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
SH256 hash:
142d82a77937c115921450e266c2fb527a21103eb2b0a23940194a734c000eef
MD5 hash:
5ef16bef8dd94970ee6465f8026c8e95
SHA1 hash:
d6f1def12f8ec07fd98a30695a590052795ab2e6
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
SH256 hash:
3e0d37643bb30ec0bb5cdbfa9117b8ca1dadaaa87d83aa676501109e8249a3cb
MD5 hash:
da5421424c36042a2e7fd67f97bd8c1d
SHA1 hash:
f6422c2efa54430bd2c1c2cf29187e0473e36eb4
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
SH256 hash:
58a2f74221a63a530896bb082168717d498bd6c2b5d6691b836c63cd172b89b6
MD5 hash:
8daad07d12ce95dbdee95cac069bfcf3
SHA1 hash:
4b1eb8ef02f89add6af082b19d610c7f7a7445e4
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
SH256 hash:
9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020
MD5 hash:
8aeb2829342f8bb9acb171472da1d64e
SHA1 hash:
b04d798d1375c242273fd6a1d8553b9312663668
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
SH256 hash:
8fd9fe29be30f381199070f2c09d8213c0ac8be98836086052bb83fe53d7f6c3
MD5 hash:
2306789692c2e5e8ea14fe50fcb67f8a
SHA1 hash:
c8b5ebd3841889ece6b1fb8ee62d6b3aaf752912
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
Parent samples :
e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a
9d0618a3a6027f47ebd85a126770e86f37e6e47b35f2175e7fde30acf1d73020
578873c16060e04fcfe43f9c9c04d2779a09a7566b3b4e97c1b18d87ac381057
04aa55e1600b801ddda368268eaf6f2ab9858f402b526468d727a943eadfb122
ce3c9c47d811745d5534bf268331382438b274a112d2327396cdc8623e82f98b
c7b06e2840e703c98fbe1fbfd9f33f5478e58840112d85c1e94c27a34474c95f
149c80ebeeead2dff7b45f8a627d5396b995f6afc82f18487d7c6eb4bf071205
SH256 hash:
e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a
MD5 hash:
40c32c129e09d3eb618e27eb168aaadf
SHA1 hash:
6a35a5fa5a53ceba217c66562477e954aec8eb2b
Link:
https://www.unpac.me/results/3ddb11a1-635e-43c3-9f53-7cabdbae75ff/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e09eaaa70726/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/e09eaaa707261756f322c8d5b12af0a09c575ffbdd7bf19b895cab4982b7f68a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/379913/

Comments