MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30
SHA3-384 hash: 0f9c7dac796001b4b8d736a3e60db6183eb81cdb32dd40fa2b17a42b1fc07d4910c833b1cc07bc47288a1db006c3405c
SHA1 hash: 874a111afbb765814fb282ebaf097263a444a4c6
MD5 hash: fe150b611f87ce38416120070b0c83c6
humanhash: social-alpha-beryllium-butter
File name:SecuriteInfo.com.Win32.CrypterX-gen.20023
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'168'896 bytes
First seen:2022-09-09 04:40:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:K3dex1BWdg+jSEvuiLO0z/95ftCUucKdisMNocK2YD2E4Ep0ZFB:ge5P+lfJ9p4+KIlNo72YDl4L
Threatray 5'044 similar samples on MalwareBazaar
TLSH T17F45084361804CA9D47740F468DDD43216A7AE88E57AC0097FDDBE6BF2F3B2110DBA69
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter SecuriteInfoCom
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
362
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.CrypterX-gen.20023
Verdict:
Malicious activity
Analysis date:
2022-09-09 04:43:05 UTC
Tags:
snake
Link:
https://app.any.run/tasks/22d7cdad-c89a-4589-8941-5dae48d77c85

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/308910/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.20023.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/631ac458d94ccae41087130d/reports/9744b370-a9ac-4459-96ce-2ebe8e609cc0/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f95112fd-b7ab-4d3a-9c9f-499f48ee7aa5
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1067565
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-09-09 03:52:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
36
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4nkvzrs6y6b7ukvfudc4kzpcvq3tjb73z76yhwzkafhubleyhuya._file
Verdict:
malicious
Similar samples:
075d1ac0887f0028c537e2b45c1d1686d26e18464792ca65b374a4ac82261d93
SnakeKeylogger
0a6d0d3564e7e3a9cd3c0f186f8f5ab59c70551af31ca1dbcbc5245062ac3cce
SnakeKeylogger
4cabc67885532fc14e52b5afe2e376074663d96f4a9f599ea723efdd63d3c719
SnakeKeylogger
5c00ba81ba3c63b387be3c81b197a552de1ba46a1922c696d602e4fbf1700c01
SnakeKeylogger
6e3068d40a7f9cf1c1b32ce4c58931efe7363b9f2d9c96117c72e8c5fa90c723
SnakeKeylogger
b3f7646d9cab31ed0eba819fbce5f17ec63460f168b6f8f330161a9fc6ff0644
SnakeKeylogger
bde44d28af8eea00ebb87e8a609fba8ed3e7371dfc1b5b842ef1a2aac4a0819c
SnakeKeylogger
e7bce95f8d0c0afe68c7073eb88a60271388885c07bd9a5abfcace139eec9e9f
SnakeKeylogger
f92f663f8f3a0eb9aa71214253b157153bc4c9b386e4189c00017ec85e9d6913
SnakeKeylogger
+ 5'034 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/220909-fa4f1sdedm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5587666659:AAG8NrrXJQs__dhk8nLJBFOspz2my8OVpX0/sendMessage?chat_id=5569775004
Unpacked files
SH256 hash:
8b533ffaed24e0351e489b14aaac6960b731db189ce7ed0c0c02d4a546af8e63
MD5 hash:
dbc7be56e6e32349315170599c8b333f
SHA1 hash:
d8e5840e3574b87d435e55a65ac648e040871aee
Link:
https://www.unpac.me/results/873ad9d6-a4a2-4424-abac-5aa457e5a6b7/
SH256 hash:
bcebe54dbf3197e990cb44d0aaa09ef9e32dad0e06d66e8cd96102110bcb7228
MD5 hash:
5b71807fa734cf347624cde7ef8f375a
SHA1 hash:
a3bcaa50f0054f09e682a9e64624279abe0c013d
Link:
https://www.unpac.me/results/873ad9d6-a4a2-4424-abac-5aa457e5a6b7/
SH256 hash:
0a62c3a76638dd7e5af9bc2e365c5032b74af2b2b00589a6980a17303fadf9ff
MD5 hash:
e5ba421e3a0cfae94fa5b4a192f85362
SHA1 hash:
71e89019758336d47757ff7b9af608cb52248c0f
Link:
https://www.unpac.me/results/873ad9d6-a4a2-4424-abac-5aa457e5a6b7/
SH256 hash:
22ed2d33ff3efc42edd8602f4f223f35da9673b4c79ff0cbed74b86d4f917194
MD5 hash:
36d0125da5cd14ea38f7a8ce5dc97d52
SHA1 hash:
684df4819a2cffd9e47b62ba88faee6f554fb0ca
Link:
https://www.unpac.me/results/873ad9d6-a4a2-4424-abac-5aa457e5a6b7/
Parent samples :
82e93820bcc88b4848f8f59f2c35d647647fd1227db2ab19a3f1e2fd896d6e7e
492f6e57a70f76bdfe306f542c58f9a98c68738bc30e30180a9d6c2ebd542401
e0cd24aec11fb4e4cdcd1e5932ca75ff201ab1087be33d3a3f94ed8e18a4eff2
e20f986eb07a1de8542737cbfeb6c959c941f2d4504e97bf05ccc8f0ce828f2e
a5102400568b0ec64884225f346921964b8fb4101db1e7dcdb2c7570f4161ecf
d1bbb9bd1eea0d574c0cd6a9d21f0a93e28b8d5be02ab39aa4671357d96b24bf
48ff3233c3694371ce56482b7d430918c75b4efe5f34b6f27877c878e43f4f38
c1b1bb430d273c5d98ee403072a3eb65ea39a0d0328e495d5cc5963d29e236d5
e53f8ac6297f4a8077eab28ed4997b81a4d91852c474618c58813a5891532adb
5e344f707afdedbfb16e731554ca97ff73407546bac845e9342d6932c6fd5a80
56589d4ad6f44f446964d2fa294809ca1e1ed2536b6c4f51edc4d0d8fc736a53
e5165182da8bd01399c69b5bedafcaeeadee92930ce267a3254edd1035a81dc1
736e89577a2db6e26bd174c180bd45af90e5686338c1207c543110df01a917eb
5b4d45802ea6070b703cb854278045a3528b7c1116e705f0cef2ed413489a4bc
34b985816a4baaa57d09048330b0c2a217485e20899aa36e7caa1d1494d171a7
914fcf53686f280284ed3b0313f62b1b84c443a95d65d1908fe5fee1f244a29f
8142fa023d2c326c8ff5cd9d50d10aff573e47d327ee466898411f60dc70a659
e0be66e9fe306de304b7f7b9227c124b9eeb9b0cf4afca86f64bdd057477ac2f
89bea1de7b7cc82a227134795589bf54792492d6d4ad81740cd551457ffdb2e5
f814f4fe8d450dc8cfc62cde57a5e4a2e72bb758f1c2d71f8483ab20315a571b
4c743eaedbc97613e8759c49e069f872bc786187cb2975a9564ab0aec2cd2205
22805984d67d2c9a896aca6d757a00e3adde2b538efd3b8a196fea685e9f9981
cf11ea9c0fb7a0bb58a7a426205f272a3d0f3572640d02bc4c925e23ae0d932f
7b65abc8f368961c4667c59072f5e35501aa3b8c5287246641d1b92a144edec5
bbd879991b1f6519e7fa6949fcb98604afe48667720394e3bec4e44cab9b3bea
d44d3dc5889b2f476fcd9413aef8041b692d28c11ae9f5f24018aeaebe35f7c0
499439f56127a77db15051a32a4b19fd43e98dfe9a3373dd008b60102a2d7d79
4fe0c19ffedd6a50fc9183a15ada9d4c1ef01879184e467ab5dc0392dc132c83
7a1be9cf221328688b575556f901eb33100299fc6488baf5a5c7b3611cad95f5
b6692385658a68fc7071fa263592322ff531ccf8267deccd9445a835b322760f
0ce000926ae7f2490881f580edeb841f172617d754fe24dac8305e22235559f5
26d40d55e47d0d62e5caa555615d6ec45bd5eefbc2e2f7d0be6736433ba5d0fb
6326a8dae7e332cd059ba1cab68aa5d50a517e7d09345cd1ccfb0f75c97bf4cd
4e9c0ce7fa6f96767cfee4ba612d9619b07e83267588d4f13b7f87269562e0cf
09f6ff9af9a4dddea8121cb0f20eb64c16b5d85386050a04354681b2799faf87
50b84cbf33aa07df940aa865fd2d59bd3154375e00f57e5e5a298e7971895879
4a758929930ecf0a804975bf90cdf639baacff62dc03692b358021bcd2f76735
743bbc2a92296c88b68bafad57f8f967d48acf35023e9bdcfdd1d0f9f672a0de
279d0d374395dcf94a678ebcacffdcc0f1cee1ed2e02530826870f0841623fbb
05e2bda13b608d5981b145995723ba0cd44832b2ef4a0d2b6f0ab78c9c4d5b2d
ca218e56143dfab73d7066f98227804de7098df11a79658794d00b5358f56f82
898da3660c91d1e919cc0a330e6b9d9a00a72afc1f06c33cabee346d7c03df06
6c92c0a7566c67f67330f52bd2b3bcd86c5494126be9b66220ad73e7710de1d8
ea3605219638f6d67dde5ccedc1d1c12bcbf26fdddab503cc497aed1fc2ad9c6
81b3ee48efd3c8cc795f8aed301eebc2dc9409a955b34be0d2248fd7a837a227
eeee70d0a88095478c4ab938f5954151a3f18b86ecf23b2cd3ade775a1e5c9de
8fe1fbda137d7d1a5ee48332b6c076a9536537dd660239a251c1877ed886f0b9
184aff1b65ffdbd8c458dfd914d44a24c73956cdaade19d7539dda6bfc184cb6
7f43e21866f496de451febc54a4f637924417c3739a78adc590e5f0dc6222365
0f11dbfcf54ae858d3ea4c0e55024bf6970dda07577d06ee0340e55a4cfaf2e7
bf3d593e6c12541ff7c42c1398fd7d8223502cb019f9d8196f2429d86f1eb092
802015736c4eca25f3de84e123bb9272cf223e266ed63663aca940aae684d027
fd06e742f4084578228718b6f66aea3fe4ff11075bcdb83f3e7c235ea9e08401
57a6c53ce23f415d86edf60106317f3629c437453b184d076ea33a6815c3f269
00abddb5c44b7746ec241613dd44d23d6dfc796211083c4143916cb1d256cd67
7778b77cc307621ef43273a4e16fd9fa720c5d21bf4ad3c6ad916e1f6edda290
da6ec3d742185761a51b0186548d7fa81690f4a19f0977770955a804e1493f82
SH256 hash:
9b4aee132a0228378d66a57fda3a2030952309ef74cf2db724ac916b04d8c034
MD5 hash:
93c6391d23c1aa1ed66fb13f82f2ee31
SHA1 hash:
220098c3047c32b51ae13a5cc1e9beeef3da6e18
Link:
https://www.unpac.me/results/873ad9d6-a4a2-4424-abac-5aa457e5a6b7/
SH256 hash:
e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30
MD5 hash:
fe150b611f87ce38416120070b0c83c6
SHA1 hash:
874a111afbb765814fb282ebaf097263a444a4c6
Link:
https://www.unpac.me/results/873ad9d6-a4a2-4424-abac-5aa457e5a6b7/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e3555cc65ec7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/308910/

Comments