MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8c7994b874107f3d4d5640a2ff3878fcfee335066b315904079d302dadbdb53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8c7994b874107f3d4d5640a2ff3878fcfee335066b315904079d302dadbdb53
SHA3-384 hash: 27236841b8263115630f97f32793b01f8b321d8cd4f67e4dc63e955a675f0600f76478b1f4398d6ff8c1d396d58e7358
SHA1 hash: 80aaa4ec8dce4f0de0be0e7c27ed366271ad0804
MD5 hash: 1337a0d8794dc9b93642ef0507764370
humanhash: south-robin-batman-idaho
File name:9mjMesSNoTxT8vl.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:841'728 bytes
First seen:2021-07-12 05:35:44 UTC
Last seen:2021-07-12 06:57:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'653 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:U6JS3WwMDNls9lOd4+QrjDT8yreVkLxuD9YBEgHw2QWKW5CK74PN+BDm:U6JS3WwndrHdA6EgHwfBYCKEQBDm
Threatray 198 similar samples on MalwareBazaar
TLSH T1740506E923BD9045F13AEBF06B1BAA474E5EB16D512D73090FB186C63821D70BB76072
Reporter cocaman
Tags:exe HSBC SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9mjMesSNoTxT8vl.exe
Verdict:
Malicious activity
Analysis date:
2021-07-12 05:39:49 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/1c3628f5-9212-47fc-816a-5a1457a28414

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/170874/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.ESZ.genEldorado.1519.4245.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bd37ae0b-5272-46d6-b6e1-5090b6902858
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814511
Signature
.NET source code references suspicious native API functions
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8c7994b874107f3d4d5640a2ff3878fcfee335066b315904079d302dadbdb53/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-07-12 01:22:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ddzss4hied7hvgvmqfc744hr7h64m2qm2zrlecaphjqfww33njq._file
Verdict:
malicious
Similar samples:
109bd7aa6730a6b04f730b3fcf4f19b9ea9d9e2cb465315dabc2c6f3519ba5f6
SnakeKeylogger
21fdc7575a436316c0235f3240191d0e4773e8a54d1d088c76cfab7c705bb0fb
SnakeKeylogger
3de2043d5dc6aa1879f040d9c69e905424acabe29ac4162752bbf57f83ae58a6
SnakeKeylogger
48b0e86fec639744a4907f199f83fda003f53d6d705a6f767e6796ab9e67bdd4
SnakeKeylogger
578aa3607cb34fde024d099b916e61c0a767d952312a2e8c9276f3167a65ad14
SnakeKeylogger
69950e3903237ab9d6441a23af192268cf49da8e1034f77990833a60738090a6
SnakeKeylogger
b5e1daebfb2aa234328dc9776a1ecc77dd2726a7709c353c0265d8b1f4803f1c
SnakeKeylogger
b9acd58a25a9493713c0b5a3be62db4338de550aad1b23054d4be3de0c1b0c46
SnakeKeylogger
c4e1ba047b2fa0d07de6a124e882025489d5ff95e2a2cef31c4526199636f3cd
SnakeKeylogger
e0c5194ec5dd17f0a5f77c156e99deafdee0c6e25b5c54c4bedc7bc5420f3a1d
SnakeKeylogger
+ 188 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210712-k6xrvysxxj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
5f5257e30cfc2caab058013ffc60f90fb8a5d780a14834e1371054290b7658e4
MD5 hash:
b0e14c3526d6623ae9b7b5f5e0efde76
SHA1 hash:
f7d127bff2dfb1100ebd55fdd12dfb7a2b382fdc
Link:
https://www.unpac.me/results/64b5db71-363f-4489-900a-9e8b589296d8/
SH256 hash:
2056e0da9c286be228b36a024c8208affba5f1d5341a5e7269ecc67f3cd09cf4
MD5 hash:
bf8440d264d143e7c6895e78b819cccf
SHA1 hash:
cb94dcd7a83127a76501521347b5208f7ec2cd1b
Link:
https://www.unpac.me/results/64b5db71-363f-4489-900a-9e8b589296d8/
SH256 hash:
e8c7994b874107f3d4d5640a2ff3878fcfee335066b315904079d302dadbdb53
MD5 hash:
1337a0d8794dc9b93642ef0507764370
SHA1 hash:
80aaa4ec8dce4f0de0be0e7c27ed366271ad0804
Link:
https://www.unpac.me/results/64b5db71-363f-4489-900a-9e8b589296d8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8c7994b874107f3d4d5640a2ff3878fcfee335066b315904079d302dadbdb53

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip b93f83fd7139d12cb86f72642875d058b646f89c969daf7fcc9d223a231e1078

SnakeKeylogger

Executable exe e8c7994b874107f3d4d5640a2ff3878fcfee335066b315904079d302dadbdb53

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 b93f83fd7139d12cb86f72642875d058b646f89c969daf7fcc9d223a231e1078
Cape
Cape
https://www.capesandbox.com/analysis/170874/

Comments