MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e
SHA3-384 hash: 7317f37100813cfb112e15f5653e19dc726ca2197d8b4ea7fa5a32585fbea6f0a90850fdddbeb01ae8ab325bfba95163
SHA1 hash: 11ecb06e2b95e8d07282cccf8335990f7fe79b7e
MD5 hash: cb25a59de77f8d5572a8994d0b911fa4
humanhash: gee-oscar-missouri-music
File name:PURCHASE ORDER..exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:589'824 bytes
First seen:2021-01-31 07:45:34 UTC
Last seen:2021-01-31 09:58:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:CxAeI5/DM5JjiGVz6Nat8+WTUUtkuUEjTqa2BC42sXFE9W:n39DM5hiGVz6Nat8+WTUUtkuUEjTqa2v
Threatray 26 similar samples on MalwareBazaar
TLSH 99C4BFADFEFE8C52CC9A437AC6A48B453BB03B12405AD715409344FE69F7F904162E6B
Reporter abuse_ch
Tags:exe SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: air.nseasy.com
Sending IP: 64.37.52.73
From: CHARLENE YONG <sales@ricoeng.com.sg>
Subject: RE: INQUIRY FOR NEW PURCHASE ORDER (URGENT!)...
Attachment: PURCHASE ORDER..zip (contains "PURCHASE ORDER..exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE ORDER..exe
Verdict:
No threats detected
Analysis date:
2021-01-31 07:47:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4fffded7-a69a-4f1c-ac64-24b0f33f94e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/114921/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Sending a UDP request
Creating a file
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Unauthorized injection to a system process
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/594726
Signature
Allocates memory in foreign processes
Binary contains a suspicious time stamp
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e/
Threat name:
ByteCode-MSIL.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2021-01-28 12:21:09 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ycj3wywxtslbi34zzmbqauxns3jmjbsa4lszbdbxit5qwki7vpa._file
Verdict:
suspicious
Similar samples:
47ffaf572157824fb5a40a2706bd72f3e0e43090c621c9d676031fd80bb35fe5
SnakeKeylogger
4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf
SnakeKeylogger
4bfb4ba69396cd0e53407019e30928d4be9257e3b51ed78587123f9a22d23ec5
SnakeKeylogger
55b85c50614dc59af0cca5ed20dc7713f784b70b16f65fa01163e48ec006be57
SnakeKeylogger
5cc38d4a28e3609654ae3975d062a71272bdaaa655d998498f2169c7679bb19e
SnakeKeylogger
71908b2defae460e3fef4b3275a66680bb518a59a8b0d740e61f063ff9eece45
SnakeKeylogger
a821247cfbed9095b7e7686eeca6572b9e506e080861c11c25be542f163a2500
SnakeKeylogger
a8aad152f516add6a277e2634baa324b105a90c3b02935aa2fa11ea4f0c4667e
SnakeKeylogger
bc58f1f37527b2256089b3fedbf5044ad396b267a762ca7e7f6fa7c81f76259b
SnakeKeylogger
f8150a05d5a773b8879bd7bc37023cde597609c47bc3bb44b05f8a5677c65939
SnakeKeylogger
+ 16 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210131-jyy68p69gj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Beds Protector Packer
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e
MD5 hash:
cb25a59de77f8d5572a8994d0b911fa4
SHA1 hash:
11ecb06e2b95e8d07282cccf8335990f7fe79b7e
Link:
https://www.unpac.me/results/9d6eb9b5-84cb-450b-be2c-7d567cc28ce6/
SH256 hash:
f01701516a91d5ef62f58f52d49ee06f5f2edde19ec54bf3d49baceb173124d4
MD5 hash:
4150189aaf4246cf9386a047c6367bd9
SHA1 hash:
18ab0cf518cc95745a0cf4ac7235358193be97bd
Link:
https://www.unpac.me/results/9d6eb9b5-84cb-450b-be2c-7d567cc28ce6/
SH256 hash:
b9bf2f29edb6d1415f2ac365e946916d974fa5c66da84e1e3b67c41781d13f22
MD5 hash:
f687f36364097ed35a04d05c3e4eb106
SHA1 hash:
df8883a2bc8ac9bb53d22ca55414bb9a709a3b37
Link:
https://www.unpac.me/results/9d6eb9b5-84cb-450b-be2c-7d567cc28ce6/
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/9d6eb9b5-84cb-450b-be2c-7d567cc28ce6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 6c225af088b7ba705b6b7c1d6f0cc8905f3456ec776c879cba36d4de32534999

SnakeKeylogger

Executable exe ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e

(this sample)

  
Dropped by
MD5 b51010a60a3ec0ec3f55c9dd2ce5859a
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 6c225af088b7ba705b6b7c1d6f0cc8905f3456ec776c879cba36d4de32534999
Cape
Cape
https://www.capesandbox.com/analysis/114921/

Comments