MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9
SHA3-384 hash: ae8917cc25748fe2ba2377a12355b333a104de35770bd967e08da00685908649470e40e0ad65873b101758bf2a69fe6b
SHA1 hash: 260435b2d95fe6061bcfd5cac05926fdaac6cbf1
MD5 hash: 6c791407d6c0b7adfdaea4ddf0430dd8
humanhash: fish-three-blossom-ohio
File name:GstInvoice-Jan-2021-xxxxxxx0006.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'013'760 bytes
First seen:2021-02-16 14:12:10 UTC
Last seen:2021-02-16 15:38:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:JkTy5aYQ6Z7iYtU+wkxlneln6DnDWWtpxn69eGjomj:dF1Z7iYtlo6Drtpo7Umj
Threatray 235 similar samples on MalwareBazaar
TLSH C525CF3267186F5CF139F33C40291558ABF5F80EE321DE5E7EDE85DA0429E08A7A9523
Reporter abuse_ch
Tags:exe MailChannels SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: snail.cherry.relay.mailchannels.net
Sending IP: 23.83.223.170
From: ICICI Bank <gstinvoice@icicibank.com>
Subject: GST Invoice For the Month of Jan - 2021 for XXXXXXXX0006
Attachment: GstInvoice-Jan-2021-xxxxxxx0006.zip (contains "GstInvoice-Jan-2021-xxxxxxx0006.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117336/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.543.19410.2142.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/608993
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Beds Obfuscator
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 14:13:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5dphdy5vz7xxo25xinpouzjvurk7hmwls6fcj4i3h54lx2pgupuq._file
Verdict:
suspicious
Similar samples:
20fe1d90bb66801400e3f746afb2408c1f17a772282f82bf707376559395e9fa
SnakeKeylogger
3ae83a13a6fe98f6d3b293d69aa7e58e4752e4b1353978e1a390314f725ea44e
SnakeKeylogger
4edd4c06c8b7cca23fce60e854323b80835e64c805daef22994f2d3d743dd83b
SnakeKeylogger
5967386e3a83cb9e0066223388892aade38751662b856048184c262239411aae
SnakeKeylogger
796283950089c8792456eb6b2f89a148de3def99691115ae7aadf8dc930d4d4a
SnakeKeylogger
7ffcfe208773bc49ef7a0e832fe117592b8eaf83484ebc9cfe9c64eb354aadec
SnakeKeylogger
8247f1c9100f98350ccc39ee0512d24a86c29881763eb262197347908a1315c4
SnakeKeylogger
82b2605b25b8443229154cf16788525e9dab3bdeff6b305792a11c0d5cd8e99f
SnakeKeylogger
e23dcdc950d7fbfe5d387b5c8822f06ab74d1f9011d8831195dabb478239028c
SnakeKeylogger
e5ea618e1c51b6f724e1527d81465fb53693449199b768bacc62d0caca5c1fbc
SnakeKeylogger
+ 225 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210216-me26gea78n/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
b2499a2af35b550fbe7f541a14ff1225e1202324f351eecf85de6c8e9fc7c27c
MD5 hash:
5e732e4265622675313195dead01047e
SHA1 hash:
359c710a93c2f58cdc2a45de8dd48a6884a70645
Link:
https://www.unpac.me/results/fef8e87f-f544-4547-a0c7-6c2523cc4c17/
SH256 hash:
e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9
MD5 hash:
6c791407d6c0b7adfdaea4ddf0430dd8
SHA1 hash:
260435b2d95fe6061bcfd5cac05926fdaac6cbf1
Link:
https://www.unpac.me/results/fef8e87f-f544-4547-a0c7-6c2523cc4c17/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip a8428a0d44d4b365a53523ee05336a0f23db2b1f99166ec825314d3ab9132b78

SnakeKeylogger

Executable exe e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9

(this sample)

  
Dropped by
MD5 afc196606e3cd955d6bae54a3b737bb6
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/117336/
  
Dropped by
SHA256 a8428a0d44d4b365a53523ee05336a0f23db2b1f99166ec825314d3ab9132b78

Comments