MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e
SHA3-384 hash: 12b7140556bc2e515e23e6dc4edd06099fa6f192396ce4e282a48fd78b764ba6cd01a19cb2346fd3c23c71025f451672
SHA1 hash: b08539c7ccd832d27657fceaa36d6105b7d9b168
MD5 hash: 25d3fd3e9875042fc87c2ff0b917e816
humanhash: six-grey-batman-salami
File name:Urgent Qutation.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:644'096 bytes
First seen:2021-07-22 17:10:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:z7kFX3xcSbfaQlhcLuQKWMsCBBR3dQlrNHsyaUVKnp:z7kh3q8yQQjlpyr3Kl5Hzahp
Threatray 341 similar samples on MalwareBazaar
TLSH T1C3D4D074631FA704DD3887FC2C59D1612BFAA02E925DDA383F9890BD7C72BB846E0651
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Urgent Qutation.pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-07-22 17:17:52 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/8901a33b-5d89-4abf-b672-b056440678dc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173400/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dbad5c5e-6a63-4ba2-90ab-b70f1644d37b
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/820329
Signature
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Double Extension
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 452743 Sample: Urgent Qutation.pdf.exe Startdate: 22/07/2021 Architecture: WINDOWS Score: 100 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Multi AV Scanner detection for dropped file 2->48 50 12 other signatures 2->50 7 Urgent Qutation.pdf.exe 7 2->7         started        process3 file4 32 C:\Users\user\AppData\...\XWuFEiVelUh.exe, PE32 7->32 dropped 34 C:\Users\...\XWuFEiVelUh.exe:Zone.Identifier, ASCII 7->34 dropped 36 C:\Users\user\AppData\Local\...\tmpACEC.tmp, XML 7->36 dropped 38 C:\Users\user\...\Urgent Qutation.pdf.exe.log, ASCII 7->38 dropped 52 Adds a directory exclusion to Windows Defender 7->52 54 Injects a PE file into a foreign processes 7->54 11 Urgent Qutation.pdf.exe 7->11         started        14 powershell.exe 25 7->14         started        16 powershell.exe 21 7->16         started        18 4 other processes 7->18 signatures5 process6 dnsIp7 40 checkip.dyndns.com 158.101.44.242, 49742, 80 ORACLE-BMC-31898US United States 11->40 42 checkip.dyndns.org 11->42 20 WerFault.exe 11->20         started        22 WerFault.exe 11->22         started        24 conhost.exe 14->24         started        26 conhost.exe 16->26         started        28 conhost.exe 18->28         started        30 conhost.exe 18->30         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-07-22 02:39:51 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5sygfgk4chz5dlwy2pklk2obhmvvzlq7j4ho26dsrfy6znkrknxa._file
Verdict:
malicious
Similar samples:
3de2043d5dc6aa1879f040d9c69e905424acabe29ac4162752bbf57f83ae58a6
SnakeKeylogger
48b0e86fec639744a4907f199f83fda003f53d6d705a6f767e6796ab9e67bdd4
SnakeKeylogger
578aa3607cb34fde024d099b916e61c0a767d952312a2e8c9276f3167a65ad14
SnakeKeylogger
69950e3903237ab9d6441a23af192268cf49da8e1034f77990833a60738090a6
SnakeKeylogger
b5e1daebfb2aa234328dc9776a1ecc77dd2726a7709c353c0265d8b1f4803f1c
SnakeKeylogger
b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60
SnakeKeylogger
b9acd58a25a9493713c0b5a3be62db4338de550aad1b23054d4be3de0c1b0c46
SnakeKeylogger
c4e1ba047b2fa0d07de6a124e882025489d5ff95e2a2cef31c4526199636f3cd
SnakeKeylogger
dc5458e66a8c76f55a5f490f5c9d12ea6e92a67c6ed74dbe40ca066a149d1659
SnakeKeylogger
e0c5194ec5dd17f0a5f77c156e99deafdee0c6e25b5c54c4bedc7bc5420f3a1d
SnakeKeylogger
+ 331 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger evasion keylogger spyware stealer
Link:
https://tria.ge/reports/210722-s6xktna3bj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Snake Keylogger
Unpacked files
SH256 hash:
98ecbd4330b1333479e0cb9c2448e403c626ae12809160bd045fee62c422dadf
MD5 hash:
9bf52104ce0e42bb6a82e6387b929c62
SHA1 hash:
e176b815f46ee50860fe3010644e500a8c097dc6
Link:
https://www.unpac.me/results/a3123a5d-b3c8-4e8b-ab52-0f8c034348bd/
SH256 hash:
295f8ece9064596807ad66f6fc16afd32072f84c734557d7f05ca532bdf14124
MD5 hash:
dc091cfda8b691ab9dc5f1f3a809f0d5
SHA1 hash:
a724b6a62bed97fb77c17766ca5bf32df835c2d2
Link:
https://www.unpac.me/results/a3123a5d-b3c8-4e8b-ab52-0f8c034348bd/
SH256 hash:
6aa4bcceb608b7da74b933f465f9dea05db4efacaf477282c9c8f2d4564a37c5
MD5 hash:
62f2b76b050023aeb3ba6748f92d9c71
SHA1 hash:
6b90e72e07fb9b3c093ed791344fd49f6318848a
Link:
https://www.unpac.me/results/a3123a5d-b3c8-4e8b-ab52-0f8c034348bd/
SH256 hash:
83d9e44d9a311ea6fdbcbd09fdc816a2067806dcacf24beb5ee786191b1a3ea1
MD5 hash:
b1a7b752b6638ee03cffe5a1dde9213e
SHA1 hash:
52d215a173d2f293990f8c12fc7f4a86330a29cb
Link:
https://www.unpac.me/results/a3123a5d-b3c8-4e8b-ab52-0f8c034348bd/
SH256 hash:
ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e
MD5 hash:
25d3fd3e9875042fc87c2ff0b917e816
SHA1 hash:
b08539c7ccd832d27657fceaa36d6105b7d9b168
Link:
https://www.unpac.me/results/a3123a5d-b3c8-4e8b-ab52-0f8c034348bd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/173400/

Comments