MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5
SHA3-384 hash: b798377ebe75b93d69015153f3a1461a7886aae770d4b8d9816bfc257c27977ab925d6d58fa48813bd94d6c481899235
SHA1 hash: 100c6b770dc8b3da2e3e40e92855a95b7079c0e5
MD5 hash: 97b6f2e0e7679618b9afa0a1ec40ca57
humanhash: london-thirteen-bakerloo-magazine
File name:hesaphareketi-01.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:614'400 bytes
First seen:2023-12-02 16:33:34 UTC
Last seen:2023-12-02 18:26:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:RZOdIGZgL4x75P1ahsQZzBPHqiaH80dhbjxf1v2Dv0QGK:HODH5PshsaPHqiI80d1jxfGvO
Threatray 310 similar samples on MalwareBazaar
TLSH T151D4E120F1F95B12DAFAA7F5145466140BF7785AE47EF3290EC9A0DA2662F004E43F27
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
292
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/461901/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/656b6280fb43e835e6bbda9d/reports/e1a1b729-8ddc-4056-904d-bb41d4a2ce28/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/96dce3b8-cfe9-461c-bdef-4b5233b0dd25
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1352103
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-01 13:53:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=54pvttlkgiqgbsqjvytbd6u34x3ai2ngyhywk6m7em42tdfislsq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1e5aaff948f19f643319f41f91ce20c6b3e3ceca9084334b7910294bceff46b0
SnakeKeylogger
2e070bf82e1dc22ca1b3612faaaed7688cf8041b14cb1be60b953e25d7ef1919
SnakeKeylogger
308e7b13ebf2ff903af13f2c81dd79489c4cd3fde26a3bd033890922b33ea519
SnakeKeylogger
5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d
SnakeKeylogger
ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5
SnakeKeylogger
fb0514347c4e3087847d4457e4dad6e14bb018ab1881bf7d64ea3bebdc308391
SnakeKeylogger
+ 300 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/231202-t23wfsdh8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
bc99dcc182eaf17394c34611c1aef4ad45c3079ae116c19caa17620d64c39f7c
MD5 hash:
84fe0cc42b4f30e7b6f58c92f9ad3d56
SHA1 hash:
d753cc7cc8e2927f9cde57fb67b5bceebd2f5fd2
Link:
https://www.unpac.me/results/a4a36670-ca8b-49b5-9574-9dd249849c9b/
SH256 hash:
d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5
MD5 hash:
579197d4f760148a9482d1ebde113259
SHA1 hash:
cf6924eb360c7e5a117323bebcb6ee02d2aec86d
Link:
https://www.unpac.me/results/a4a36670-ca8b-49b5-9574-9dd249849c9b/
SH256 hash:
992b6308d41e27cb9a8b6a3ad4ab3c2c9e6d1b460b9325b17fc0249db653fb80
MD5 hash:
5658e3b2171177f474e7d1077fab64d5
SHA1 hash:
ab152c34ff0648221382d98967a0c6aee2266075
Link:
https://www.unpac.me/results/a4a36670-ca8b-49b5-9574-9dd249849c9b/
SH256 hash:
0e8a5f6bd3e915b9d2fae9428730dc5017348d23b622bccbb1971e352052734b
MD5 hash:
56feb04fdc8b0453c62267ac204ed555
SHA1 hash:
7d41fb41cac90bea85cb6691a5945568115cbcbf
Link:
https://www.unpac.me/results/a4a36670-ca8b-49b5-9574-9dd249849c9b/
SH256 hash:
2cbedf8a5a55e760a8dab3c97a25bdcb72b7bcb59b3d934dc582ff017d98ce87
MD5 hash:
07630c805697938d4629b34599b9765c
SHA1 hash:
36ec2edec9b1cfea7b7b01d37e92865521b72fec
Detections:
snake_keylogger
Create hunting rule
win_404keylogger_g1
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Link:
https://www.unpac.me/results/a4a36670-ca8b-49b5-9574-9dd249849c9b/
Parent samples :
a3ba5851c9d979b726e0c0e28e3dc4e7fb896b9198c592af71791c20a6c8d081
6ea20989d66aa35efba273fe6d634b8a7c269c7f03a8df6dcb9c5653dcbba810
ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5
c7c0a22744179c319910d7c9508866ebfc6d35beeee844b8462bab9c04af4b19
1c058ff86662b1c0157e5f550ac61052fb776859e5d7ffd2a73f5c192b509058
SH256 hash:
ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5
MD5 hash:
97b6f2e0e7679618b9afa0a1ec40ca57
SHA1 hash:
100c6b770dc8b3da2e3e40e92855a95b7079c0e5
Link:
https://www.unpac.me/results/a4a36670-ca8b-49b5-9574-9dd249849c9b/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ef1f59cd6a32/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/ef1f59cd6a322060ca09ae2611fa9be5f60469a6c1f165799f2339a98ca892e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/461901/

Comments