MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0f2298d191750e9e605b5038f70b14e1bbb1091bed8e8e94837e3dbf35bfdc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0f2298d191750e9e605b5038f70b14e1bbb1091bed8e8e94837e3dbf35bfdc1
SHA3-384 hash: 3495cac9c185e98a379d6b2759fb466dbcfde8ecb3c881cec41023b81bd51ce40c3e641e77205c4feedb5b0b565c0001
SHA1 hash: 49aeffff9d776cd50f517ef321b135c5fb0bceee
MD5 hash: e9ff414dcc5cd84640b29bbaf34cecb5
humanhash: alabama-golf-fish-stairway
File name:Scan Doc.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:553'984 bytes
First seen:2023-04-04 12:00:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:0IIGhF8Xn6cJCl8GmUw7eSUBNhnOrMSyAPa7zhyCxG:0IhgKcJALLTBNhnhp7zhykG
Threatray 5'067 similar samples on MalwareBazaar
TLSH T117C4124A3B74A72BD23C57F6E863201A43B1963EB162F36B4CC515E84F7BB818590D93
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter malwarelabnet
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Scan Doc.exe
Verdict:
Malicious activity
Analysis date:
2023-04-04 12:01:02 UTC
Tags:
snake keylogger trojan evasion
Link:
https://app.any.run/tasks/3082fd28-3e04-40ed-b9d2-51f710547027

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/379997/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.10051.12933.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
80%
Tags:
packed
Link:
https://www.filescan.io/uploads/642c11485df5c94ab9b85fd8/reports/ee5a7bbc-c7cb-4872-a5c1-cce76f728482/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/e0f2298d191750e9e605b5038f70b14e1bbb1091bed8e8e94837e3dbf35bfdc1
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d468e0a4-180a-4ee2-9ca2-f437548fd6fa
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1208013
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0f2298d191750e9e605b5038f70b14e1bbb1091bed8e8e94837e3dbf35bfdc1/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2023-04-04 08:30:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4dzctdizc5iotzqfwuby64frjyn3weerx3mor2kig7r5x4237xaq._file
Verdict:
malicious
Similar samples:
37b2ddfa8c9df304a83297c03f7cfb27ea096408a990b5611cedde715cf56eab
SnakeKeylogger
7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5
SnakeKeylogger
7ce6cf0e5a6d6633a5a6aef7d6ae9fe05e4ee2fffe4e7d4a2e5f7cf2562b07a1
SnakeKeylogger
84a7b931079a581a4e3334a3be74e9c16876b1f00c51270f7eee81df6738340a
SnakeKeylogger
bd3704c36cc99d990c773ae12328f7938e7a5bf230e18501f2f8b869532b28d5
SnakeKeylogger
d156d6626e85584270b990b2b53c325a53be473e21c6fd32e1ac4e50301ee165
SnakeKeylogger
ddf534695055117a966d111e1102446be62148e55eadfcc5a01dd2b444ffc0e8
SnakeKeylogger
e9fe41087ecb0d059624fd69ce267cca7bf10f38c96f3d5e1949ecbb2d48b623
SnakeKeylogger
f2c53057334b62ee92c3c21f8b8f1f5dbacda5d79db75734abcd879c08a7c805
SnakeKeylogger
fd6c69d8a9592b239028cbe1f7180a1513f0efdc6745f6fa41dadcc6b438cc7b
SnakeKeylogger
+ 5'057 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/230404-n6bd4sef99/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot6273588619:AAGTKdaHpSx3jesNwbj5Tnehob7IZl363rQ/sendMessage?chat_id=5353033208
Unpacked files
SH256 hash:
ec20bb2cbb58ecec077f62b366079bc73cb5c0d52d7bcfe72a8f11b47f533226
MD5 hash:
564d7c8847feac6d94fdcd1cb9aa5b5e
SHA1 hash:
ec180922fbe20ff2f08f67f3bf0021d13d970f2a
Link:
https://www.unpac.me/results/51c36a29-7091-4038-92c2-abcb7a5adfdb/
SH256 hash:
9c569049891025fd08c51bcc1a99af368b65f8e7245e4cbbb1bd7242056b2ec5
MD5 hash:
ae9a33321890b814c8f283c2c52be782
SHA1 hash:
ca4f7fa3cfdbfc74aec45825626b7201b0b46369
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/51c36a29-7091-4038-92c2-abcb7a5adfdb/
SH256 hash:
22c3326f7ea11380fb4846906faa8773d2749692ac923abdd919b37dec9f203b
MD5 hash:
63d71be625c62539eda15f0cb1df6c83
SHA1 hash:
bb0a277fb7ce29a95f941f5bd3ef664aa726a525
Link:
https://www.unpac.me/results/51c36a29-7091-4038-92c2-abcb7a5adfdb/
SH256 hash:
0ab14f6e90dc872a6be3796b4a2d81bd0c64839126aec9485d758d0f4c41ec8b
MD5 hash:
87c7afa43020e4f0634553ea81dcb998
SHA1 hash:
8ff917ccefe74fcd6dd85d7bff1853963bada2d4
Link:
https://www.unpac.me/results/51c36a29-7091-4038-92c2-abcb7a5adfdb/
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
Link:
https://www.unpac.me/results/51c36a29-7091-4038-92c2-abcb7a5adfdb/
SH256 hash:
e0f2298d191750e9e605b5038f70b14e1bbb1091bed8e8e94837e3dbf35bfdc1
MD5 hash:
e9ff414dcc5cd84640b29bbaf34cecb5
SHA1 hash:
49aeffff9d776cd50f517ef321b135c5fb0bceee
Link:
https://www.unpac.me/results/51c36a29-7091-4038-92c2-abcb7a5adfdb/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e0f2298d1917/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/e0f2298d191750e9e605b5038f70b14e1bbb1091bed8e8e94837e3dbf35bfdc1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/379997/

Comments