MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 12

Intelligence 12 IOCs YARA 12 File information Comments

SHA256 hash:	eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116
SHA3-384 hash:	b9e3c80ca5d6daa48d72028a8cee158bdc00a3b4f2349a25a7af4b16d2ef7554624dc064168122597886436003a71504
SHA1 hash:	5cd29a611eabc08cd9974ea167fcc99d13b6be86
MD5 hash:	89f16ff3a3796bc12ae59bf07007ec5b
humanhash:	venus-purple-grey-echo
File name:	ORDER 1.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	802'816 bytes
First seen:	2022-12-26 17:03:44 UTC
Last seen:	2022-12-26 18:34:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:SE6vNPfxg36BlIigJprQK24y9WhZzcTft+24KL4CRGdbsFUDfWqBf9b5WxZW:6Fnxg3tSL9Wh+TfP4M4CcLDuof9k
Threatray	10'170 similar samples on MalwareBazaar
TLSH	T1C205BEB3197B12C2CE6A0635D57A1D100C1DD9F90B0286B6B6D3A2AFC6496CD7AD4CF3
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	f08f898c8e8a8fb0 (37 x SnakeKeylogger, 19 x AgentTesla, 17 x AveMariaRAT)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

175

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ORDER 1.exe

Verdict:

Malicious activity

Analysis date:

2022-12-26 17:04:17 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/6ba905e3-d25d-46f1-b7d7-0ff244b2d2f2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.19570.4373.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Verdict:

No Threat

Threat level:

2/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63a9d40306f34cc0fa524195/reports/6228f1e2-b369-45aa-953b-e946e94e5f0c/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e876b5c8-9b70-481d-a2cc-c6df7968295b

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1141172

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116/

Threat name:

ByteCode-MSIL.Spyware.SnakeLogger

Status:

Malicious

First seen:

2022-12-26 17:04:09 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

11 of 26 (42.31%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5la72vszee3ckpwoh6omuvn3ymyfvhybwi2warfggfsqgesnqela._file

Verdict:

malicious

SnakeKeylogger

302d354a18c1789584296c21427577dd4d095681b6d232d07f3a1422e95f05c2

SnakeKeylogger

495c80adad64f20ab292f42de22850ba2abcc8f9a1c1eb41eda64088fd0bfaa8

SnakeKeylogger

49c9ed92eee655ab544f204f3acbf53eb9f9074434130d2d55f07c89d2791945

SnakeKeylogger

4bb9d6b2fd689b24941493f61b6c39313a35fe7e544a686b69e5a21f38db511c

SnakeKeylogger

7da5ff274247f3936df6b9d2225cc15e8990a4efec62f4f82147071fcab72898

SnakeKeylogger

b3d857405bc06ef7e5822e4d12f5d7128bf50ba6068553ea90db865b35a19a88

SnakeKeylogger

b5976eb47b7ee86e14820c9ec28dfda460cefbcbcf9936c711512b9fd5260c10

SnakeKeylogger

b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce

SnakeKeylogger

+ 10'160 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/221226-vk87ksgd41/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Unpacked files

SH256 hash:

fc6485350cf55dc14ecbfd9b91b7a9979f61023b4104101e9f351caa6c73abaa

MD5 hash:

6c3fdb2b5d93cf814ea1b6ca05a0efcf

SHA1 hash:

f8ae5f9fa1c9b6b0e47b2f0873d2ee3373e0ebf5

Link:

https://www.unpac.me/results/bd5a8835-0b4b-458b-b453-d0f2707fbb66/

SH256 hash:

67831417a9445ecc579ac1802f76cfe1a1c813f663ddbdbc7c21926a2210d9d0

MD5 hash:

82d7a0830f7941903acd1df67ae10280

SHA1 hash:

906947993281a8ae16285d4f2dc2f52dab024d07

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/bd5a8835-0b4b-458b-b453-d0f2707fbb66/

Parent samples :

b675693b9b4cb58c64df75a0968f1ac36c8d5489d3c9ef49a3d5442f2e1f34ce
b5976eb47b7ee86e14820c9ec28dfda460cefbcbcf9936c711512b9fd5260c10
ac74957ffebda2f33603be3668eab0eaeb0deb26874cc2f6f877ef0e2c85cd79
f149ad4d9fc4f3d0dc4cba5a0d1419ad81dc0fd37b179c5bff458ea3666a4c6c
062d1412e5065ad96e3bedcc9a721caf0b2744dde92edd16820c66b8f8679856
725a65de7a17d632eb35dc3e80e1464b1f279218d765cea8f4502c51b6798874
83c30df8e5efab00b5a5532d6c64bd8e4f3892a9a5c56e63f3c32eec0d33f9db
4b73919f41ea4a5bfe12da3709ca5562eef550dff276edf28a525753279f11fc
eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116
811776b7e88a6f52c43527f71c90981244e6cde742fe45a88c50b15327f5406b
fac6a7623bd40a11274201b5ea609d276e8fd43d82eff03e3136997dbe54c19e

SH256 hash:

2ef35a4081bfc586f5ef83a6e97709704487e6f91217997d398c87270f6a3ef5

MD5 hash:

69025cbb86caac24ffc5ce0146f6e814

SHA1 hash:

73b6c19272683d9789a121c803f0666c539622af

Link:

https://www.unpac.me/results/bd5a8835-0b4b-458b-b453-d0f2707fbb66/

SH256 hash:

dc7ffb0a29f5b5ef887f6e29e38acdf0a5eca82baebbfff8747359d57266cba8

MD5 hash:

0979fd41bab9bbb0c979d8e499d134b2

SHA1 hash:

688187f5e34e827fbff3edf439dd1eb13b895d82

Link:

https://www.unpac.me/results/bd5a8835-0b4b-458b-b453-d0f2707fbb66/

SH256 hash:

ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747

MD5 hash:

89ac57478044c57c7195943116a521e0

SHA1 hash:

1ff2bafeed795423e3538d810bda8e1e3fcdcfa5

Link:

https://www.unpac.me/results/bd5a8835-0b4b-458b-b453-d0f2707fbb66/

SH256 hash:

eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116

MD5 hash:

89f16ff3a3796bc12ae59bf07007ec5b

SHA1 hash:

5cd29a611eabc08cd9974ea167fcc99d13b6be86

Link:

https://www.unpac.me/results/bd5a8835-0b4b-458b-b453-d0f2707fbb66/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/eac1fd565921/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/eac1fd56592136253ece3f9cca55bbc3305a9f01b2356044a6316503124d8116

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AsyncRat_Detection_Dec_2022 Create hunting rule
Author:	Potatech
Description:	AsyncRat

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample