MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee800c211606c5adfaf0f26d2505085d08b7097dad09ccff38134c6403d51598. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee800c211606c5adfaf0f26d2505085d08b7097dad09ccff38134c6403d51598
SHA3-384 hash: 1c2b3f9daa800e6ba2c0ef4d2273884975ebc9b4c2a94931df448957e6bf1adf0ab30903b10911b13a0203f7648340d3
SHA1 hash: a0ee48d7e709642ece5b549c2045df62d82b9850
MD5 hash: bc34664fd10e7356448b787de8e14276
humanhash: eight-timing-helium-hamper
File name:ekstrenizz3.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:528'896 bytes
First seen:2020-12-22 12:50:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash db3ba5a38c467c1467d8cab70dfeeb13 (24 x SnakeKeylogger, 1 x BitRAT, 1 x AgentTesla)
ssdeep 12288:bCjurTxj0YvURk9DVz+v4AnhoYWGxBXxcVGrj4W6:b4uRI1Rk9pzq4uasnXEc6
Threatray 137 similar samples on MalwareBazaar
TLSH 87B42295550EA383EFC3ED74905224BD3F5E3EE2A78145A7D29220363E1B2C6DA7D40B
Reporter abuse_ch
Tags:exe geo Halkbank SnakeKeylogger TUR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: HALKBANK E-EKSTRE<Gulsen.AYHANYANAR@halkbank.com.tr>
Subject: T.HALK BANKASI A.S. 08.12.2020 Hesap Ekstresi
Attachment: ekstrenizz3.zip (contains "ekstrenizz3.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ekstrenizz3.exe
Verdict:
Malicious activity
Analysis date:
2020-12-22 12:43:18 UTC
Tags:
evasion trojan 404keylogger stealer
Link:
https://app.any.run/tasks/07fa4fbd-41e6-46d5-8c5c-af1ed87fe5b4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/108886/
Detection(s):
SecuriteInfo.com.ArtemisBC34664FD10E.32020.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Unauthorized injection to a recently created process
Launching a process
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Sending a UDP request
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/568260
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 333200 Sample: ekstrenizz3.exe Startdate: 22/12/2020 Architecture: WINDOWS Score: 84 36 Multi AV Scanner detection for submitted file 2->36 38 Yara detected Snake Keylogger 2->38 40 May check the online IP address of the machine 2->40 42 2 other signatures 2->42 8 ekstrenizz3.exe 3 2->8         started        process3 file4 26 C:\Users\user\AppData\Local\Temp\...\file.exe, PE32 8->26 dropped 11 ekstrenizz3.exe 2 8->11         started        13 conhost.exe 8->13         started        15 ekstrenizz3.exe 8->15         started        process5 process6 17 ekstrenizz3.exe 2 11->17         started        20 ekstrenizz3.exe 11->20         started        signatures7 34 Maps a DLL or memory area into another process 17->34 22 ekstrenizz3.exe 15 2 17->22         started        process8 dnsIp9 28 checkip.dyndns.org 22->28 30 pro40.emailserver.vn 103.15.48.62, 49723, 587 ODS-AS-VNOnlinedataservicesVN Viet Nam 22->30 32 2 other IPs or domains 22->32 44 Tries to steal Mail credentials (via file access) 22->44 46 Tries to harvest and steal ftp login credentials 22->46 48 Tries to harvest and steal browser information (history, passwords, etc) 22->48 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee800c211606c5adfaf0f26d2505085d08b7097dad09ccff38134c6403d51598/
Threat name:
Win32.Trojan.XetimaLogger
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 12:10:34 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=52aayiiwa3c236xq6jwskbiiluelocl5vue4z7zycnggia6vcwma._file
Verdict:
unknown
Similar samples:
08a8d2666394e14369192ac720209c7c947a024181e4255c62825e37165cb45b
SnakeKeylogger
1b95de55808c88599a46d6a21a0063a874a6e2ca7f0644989ce60eee025a6485
SnakeKeylogger
5bdbe509086a48374c2eb7d22558abaad0d87f61962965ddfeb91bc0d1a1491d
SnakeKeylogger
70528f1500aeffb424cc452a6afaa99ddf4b8deb61a6e41830270dfb1400589f
SnakeKeylogger
81f08bb7f6faa0880efb94cc2fb91eec241e83b3d5b992c9564608bbe3c974e2
SnakeKeylogger
848bb4e9ca2acb33c8a183eefb65637edd6c2d837a6d490d41509896a79f95d3
SnakeKeylogger
ba427f33bcbc3f27a2bcecf21c044e115985dd0a43dbc66a7c0170854b44e39b
SnakeKeylogger
bf60e55ec0adb6a2be7a8009c201aecbb074beecd22458bf19ff12f5d5acbb9b
SnakeKeylogger
d0a531def227f88eb7cf052fb7b94b33b7a1daca060bdb464e21739d606c99d4
SnakeKeylogger
e3be5f2b9bd4b6b4847cabb927de8818ffb29e3544dc667f9962c31c92bd87e7
SnakeKeylogger
+ 127 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
spyware
Link:
https://tria.ge/reports/201222-szgg8ywgme/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
ee800c211606c5adfaf0f26d2505085d08b7097dad09ccff38134c6403d51598
MD5 hash:
bc34664fd10e7356448b787de8e14276
SHA1 hash:
a0ee48d7e709642ece5b549c2045df62d82b9850
Link:
https://www.unpac.me/results/95ac47aa-df76-4f12-a454-d9125d37f1d5/
SH256 hash:
b242596f00d714c581388c1e757c258fb0f74f3d72eeadc7790a7dc75771d362
MD5 hash:
71357f24b784c05ad2a99d01b2e06620
SHA1 hash:
89041f7a39347a8ae898e7403ae7f2202c2d4ad9
Link:
https://www.unpac.me/results/95ac47aa-df76-4f12-a454-d9125d37f1d5/
SH256 hash:
5ddcc7ed95d9f35583a72cd0b597443579536254e4067b692fb26fdf0dd29ae9
MD5 hash:
581ff57fde5cdbd7a02ee70c9e6ce701
SHA1 hash:
bede6759d9155ea51142ccb3e8695702b5b2e883
Link:
https://www.unpac.me/results/95ac47aa-df76-4f12-a454-d9125d37f1d5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee800c211606c5adfaf0f26d2505085d08b7097dad09ccff38134c6403d51598

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_Snake
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip bd3ecfa231f74a3c6152d6cb8358dfeeb6e5c18eec0f46371d99fdd43496d2b6

SnakeKeylogger

Executable exe ee800c211606c5adfaf0f26d2505085d08b7097dad09ccff38134c6403d51598

(this sample)

  
Dropped by
MD5 4896f1c7dccf9bd39779ed18c3aae63e
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 bd3ecfa231f74a3c6152d6cb8358dfeeb6e5c18eec0f46371d99fdd43496d2b6
Cape
Cape
https://www.capesandbox.com/analysis/108886/

Comments