MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee0ad75c2330cbdb9dd4eb298b4d66b84e4fdba7e44b0a5b3cd7b355cb373ba1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee0ad75c2330cbdb9dd4eb298b4d66b84e4fdba7e44b0a5b3cd7b355cb373ba1
SHA3-384 hash: fbf66e37251ac7306617cc397dc039d46812592e310f84641071f0f9d3fdca62286feae163d3b734dfd1ada2a8ff2556
SHA1 hash: f5c0027828f354289f9249d3fb79e3234801ecc6
MD5 hash: 7b420978ef6eae156311782925b10885
humanhash: juliet-moon-march-johnny
File name:TransferÖdeme detayları.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:755'200 bytes
First seen:2022-06-14 10:15:59 UTC
Last seen:2022-06-14 11:27:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:6LhBcQllnA9oxexJILRrYrzshihqlotxQYjb041su7GlFg+amk+PII2REO3jjCdo:6Kox0eRr6+iRtzb0g7GszegI2dju
Threatray 4'129 similar samples on MalwareBazaar
TLSH T1B9F41CD1F150CC96E96B0AF2ED6BA53021A3BE9D94A4C10D569D771B26B3342209FF0F
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TransferÖdeme detayları.exe
Verdict:
Suspicious activity
Analysis date:
2022-06-14 10:39:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a395f452-980e-48e4-ba91-bbcffabd591b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/279727/
Detection(s):
SecuriteInfo.com.Variant.Bulz.622261.17262.1079.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/62a860039f4b7158ec1ff9b7/reports/ac7bf31b-acc8-405d-8792-1abfaa45c914/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/22897bca-cc3c-4d78-8d87-272e2e5b7843
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1012797
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee0ad75c2330cbdb9dd4eb298b4d66b84e4fdba7e44b0a5b3cd7b355cb373ba1/
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2022-06-14 10:16:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5yfnoxbdgdf5xhou5muywtlgxbhe7w5h4rfquwz426zvlszxhoqq._file
Verdict:
malicious
Similar samples:
075d1ac0887f0028c537e2b45c1d1686d26e18464792ca65b374a4ac82261d93
SnakeKeylogger
10c2718857ad39e2dc165eea92a9854c528f169d0f9ccf887ee62e29ec0f208f
SnakeKeylogger
1abbde2370c16b13df70225a0c251790f64f3ba70067a30e959360da730eccae
SnakeKeylogger
2e0bcd0644f82dbd6f7bc920b54bf6b4a621ac938a18d35695776f44ae6bccd0
SnakeKeylogger
4f7d1f1df60c29fe9eff2e75f317a316c9ddc9afe569624a466670cf396b8d61
SnakeKeylogger
6854be3657cbb743286183f6a18048d849e9e3dd5a1ba47d1d6f2e2d05195fd5
SnakeKeylogger
b48c018d252b5974a13a65c6b67856d4f2059a90499f65037a63324e4a42001c
SnakeKeylogger
bfc2cfdeb6732fd82c5013684c3760c545b2e0a90aca8c36b3bb9049424d8f73
SnakeKeylogger
+ 4'119 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220614-masg3sdcak/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
0339843e30328ada6da8ba672e5cd9777b7473b8e7f820bd68d65c6e2066eb92
MD5 hash:
3298d3babb9d4641fb1531db0d014baa
SHA1 hash:
f06302775b56b02fd46c199ae2c28d94805b9d7b
Link:
https://www.unpac.me/results/03a357e2-0f69-4b23-bf41-7facfee6bba5/
SH256 hash:
23ebed8ff1f6bbc93df436e7fafcbd0580751b8b628761342b9bc8a96790a9a0
MD5 hash:
d53e3ef9fae38384b9cfbd817bd75865
SHA1 hash:
af3bf205ad4b51615901128d50cb10988496e565
Link:
https://www.unpac.me/results/03a357e2-0f69-4b23-bf41-7facfee6bba5/
Parent samples :
c5d0d97ecceb4b96d309f6ae3c27cbc2b6326837765322bd84b49d8dd30078ac
fccbc2322ff9606c918673a07b68c7638c0ae6bee46a8eeba60da6715a92a1a7
9eba2f0df8e90e0471810be36a3aae12bfbc808d226ffec823927e18d429753b
7ce5acb0ec259e4f3f3aef6a8da98c0bfdb0e34918076c88c5f9a462214bc687
689df11e9923fd90bf15c3aa52a813befe084d46c3f66a5105c5a9661b24971a
SH256 hash:
f41af21bd17a787ddd6980589cd9576a55d0a490e716cf0d840fbb0c196f7780
MD5 hash:
075215aa1cbf1469219f211ca6c00082
SHA1 hash:
98c623b175161752106a63372cd887e0c18aeaec
Link:
https://www.unpac.me/results/03a357e2-0f69-4b23-bf41-7facfee6bba5/
SH256 hash:
2fe9852668ae6b7715a5c6f8764744f9cb2ef3163adf0f360728f628d42ce916
MD5 hash:
26bfda201145c515616dbb9243785084
SHA1 hash:
4133e7329a79766bbe670a398fdfb442eb70487d
Link:
https://www.unpac.me/results/03a357e2-0f69-4b23-bf41-7facfee6bba5/
SH256 hash:
ee0ad75c2330cbdb9dd4eb298b4d66b84e4fdba7e44b0a5b3cd7b355cb373ba1
MD5 hash:
7b420978ef6eae156311782925b10885
SHA1 hash:
f5c0027828f354289f9249d3fb79e3234801ecc6
Link:
https://www.unpac.me/results/03a357e2-0f69-4b23-bf41-7facfee6bba5/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ee0ad75c2330/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/ee0ad75c2330cbdb9dd4eb298b4d66b84e4fdba7e44b0a5b3cd7b355cb373ba1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/279727/

Comments