MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff
SHA3-384 hash:	062b8b6aefbcc4e19fae0054cefdfeaace1b47f4507699023ebbd8ff795c1928534bf8828c7cbd24308633213a963704
SHA1 hash:	f456587ad90b2f5bed0e410db00b1300dfe4a37b
MD5 hash:	3c35707d9cacb409481600e0b5eed83a
humanhash:	gee-double-eighteen-summer
File name:	106.hta
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	156'427 bytes
First seen:	2024-08-07 14:11:16 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	768:tZ6A3yXNA0AGA0p0Aey4dAeKGfR+dfl1o1QiXAZO:tt
TLSH	T1E7E32D57D203F439DB6359FBEA7CAF9113D19E8ACE8C968F40AE441597D0ADB720C086
Reporter	James_inthe_box
Tags:	hta SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

107

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-360.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.VBS.Agent-9.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66b380b4aa5b40be0a9fd1dc

Tags:

Discovery Execution Exploit Generic Network Stealth Trojan

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis VBS.Asthma.2.4123D49B

Verdict:

Malicious

Labled as:

VBS.Asthma.2.4123D49B

Link:

https://www.hybrid-analysis.com/sample/e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Cobalt Strike, Snake Keylogger

Result

Threat name:

Cobalt Strike, Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1489473

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

AI detected suspicious sample

Detected Cobalt Strike Beacon

Found malware configuration

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Potentially malicious time measurement code found

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious MSHTA Child Process

Suspicious command line found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected obfuscated html page

Yara detected Powershell decode and execute

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4juihpk4t4fc7btvymzrzls63iz6uvbsxprki7v32fqba3xrvt7q._file

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger collection credential_access defense_evasion discovery execution keylogger spyware stealer

Link:

https://tria.ge/reports/240809-k4h5dsseme/

Behaviour

Modifies Internet Explorer settings

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Evasion via Device Credential Deployment

Credentials from Password Stores: Credentials from Web Browsers

Snake Keylogger

Snake Keylogger payload

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e26883bd5c9f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Password Stealer

Threat name:

Password Stealer

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff