MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f12bd14127772fc5ea920b39161f0c30fdf462bf9622b59eaafd7e8f1803156d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f12bd14127772fc5ea920b39161f0c30fdf462bf9622b59eaafd7e8f1803156d
SHA3-384 hash: 2be225bad4563cb3b5b6ea086a6e9e54b4ba30fef2ee21d1025665114b97e4118d963e7c816cf14e598db561bd97a45c
SHA1 hash: 7c0e71be4e69aa0abc19504d280d523bd2e2bb9d
MD5 hash: fa5701237726a021ff62e0ea470af5e4
humanhash: virginia-magazine-football-sierra
File name:Urgent Po#.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:777'728 bytes
First seen:2021-11-17 14:25:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:O+qVphCcfZ/2Yp48rnJDLw/chzeG+y8BS18ydUoXS2zG9+aw9cNq0p2W:0ak/2Yp44nJCcFeG+hBSHZXjZqN
Threatray 1'688 similar samples on MalwareBazaar
TLSH T1FCF4F11533B55F13C5BE83F49225914007F2762AA2ABE71E2CC3B1DB7E67F918686903
File icon (PE):PE icon
dhash icon c8c4e2f934dc2e16 (10 x Loki, 6 x Formbook, 6 x AgentTesla)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Urgent Po#.exe
Verdict:
Malicious activity
Analysis date:
2021-11-17 18:10:52 UTC
Tags:
evasion trojan snakekeylogger keylogger
Link:
https://app.any.run/tasks/a529e4c7-66a8-4537-9b3d-a94d8864fe87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/619511024912a8c920a17ed1/reports/b25568cd-665c-4619-8e70-aca26c85ef50/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea341981-f97c-47fc-ab5f-31b91fa6cadc
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/891441
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicius Add Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 523910 Sample: Urgent Po#.exe Startdate: 17/11/2021 Architecture: WINDOWS Score: 100 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for dropped file 2->43 45 13 other signatures 2->45 7 Urgent Po#.exe 7 2->7         started        process3 file4 27 C:\Users\user\AppData\Roaming\xWexwvt.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\Local\...\tmpA499.tmp, XML 7->29 dropped 31 C:\Users\user\AppData\...\Urgent Po#.exe.log, ASCII 7->31 dropped 47 Adds a directory exclusion to Windows Defender 7->47 49 Injects a PE file into a foreign processes 7->49 11 Urgent Po#.exe 15 2 7->11         started        15 powershell.exe 24 7->15         started        17 powershell.exe 25 7->17         started        19 2 other processes 7->19 signatures5 process6 dnsIp7 33 checkip.dyndns.org 11->33 35 checkip.dyndns.com 193.122.6.168, 49755, 80 ORACLE-BMC-31898US United States 11->35 37 2 other IPs or domains 11->37 51 Tries to steal Mail credentials (via file / registry access) 11->51 53 Tries to harvest and steal ftp login credentials 11->53 55 Tries to harvest and steal browser information (history, passwords, etc) 11->55 21 conhost.exe 15->21         started        23 conhost.exe 17->23         started        25 conhost.exe 19->25         started        signatures8 process9
Detection:
snakekeylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f12bd14127772fc5ea920b39161f0c30fdf462bf9622b59eaafd7e8f1803156d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 11:57:08 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ev5cqjho4x4l2usbm4rmhymgd67iyv7syrllhvk7v7i6gadcvwq._file
Verdict:
malicious
Similar samples:
0a80c9ca740f88fbdc0548e6cbf120dc03ee2ff243f610a1f7cc84de494f20bd
SnakeKeylogger
11f9fb92c34ae4431fd9715fc67b82ea29489135316105606cffe05944f3c476
SnakeKeylogger
12abc910bd5a6a05cdc8f1c94cc6a1968581850612c404267d63e77852cb4a90
SnakeKeylogger
222543cf9b75b95cc7c6e6f8252d2c205da8c9ec8d9c9587c19f1350b79f9dd3
SnakeKeylogger
2dae35b2c81440f320d907e58c7f331b08eff44f9803c796ea7deb1c53b5e145
SnakeKeylogger
3582856a25a8c10ed96e2ba53528ce32672f94e16cb93fb8160cc91be519e9d5
SnakeKeylogger
39a4ef63eed3420e394a7b9c0afd387ec27c4f70e1d293d2fe596ff3bf5ccd53
SnakeKeylogger
8e2a4b1e4cbecbe4f157cc6edda64c32b856fb53cb3c265c4d49175d597b7541
SnakeKeylogger
a82999d77adbff10ef701a595d165547fb73bf055dcae9b65d261e4d09c47654
SnakeKeylogger
b182edb787d497eeed41880c81331d9dee8ddfa00813672bc77f7b09a2528981
SnakeKeylogger
+ 1'678 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/211117-rrvqzsche8/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
2c8d56830c6be5e12810237f69359631ce5bebd44f360588d854b1bf7d02f386
MD5 hash:
b03f21b65936a7081dec6b7d30da2df6
SHA1 hash:
bef7fed989cb77c1be43dfb6ace7a745e853af02
Link:
https://www.unpac.me/results/d24e9556-c908-4e17-9f29-005a0e17339c/
SH256 hash:
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f
MD5 hash:
bf5c170790a9378101dbc312303925e3
SHA1 hash:
bddaf21c02ba5cec7c4dfd1b1f289e23714a8ba8
Link:
https://www.unpac.me/results/d24e9556-c908-4e17-9f29-005a0e17339c/
SH256 hash:
196732413217c4411808998c70be5401950cb481da58cfb2bf37f3c4d61de7ae
MD5 hash:
f8f61e59c1e54c6ec23148d784fefd39
SHA1 hash:
75ff23913b5d0998e3abd8f258a7810a77f63552
Link:
https://www.unpac.me/results/d24e9556-c908-4e17-9f29-005a0e17339c/
SH256 hash:
b8cb196a25245e5571abdbfb0e8ea25aab74675bafbe8dae9e25c2c72ba351f8
MD5 hash:
8ffdb130ed5e24b47c794f00f1efe74f
SHA1 hash:
3e3873ceff75caafa7000862f88593549de9625c
Link:
https://www.unpac.me/results/d24e9556-c908-4e17-9f29-005a0e17339c/
SH256 hash:
f12bd14127772fc5ea920b39161f0c30fdf462bf9622b59eaafd7e8f1803156d
MD5 hash:
fa5701237726a021ff62e0ea470af5e4
SHA1 hash:
7c0e71be4e69aa0abc19504d280d523bd2e2bb9d
Link:
https://www.unpac.me/results/d24e9556-c908-4e17-9f29-005a0e17339c/
Malware family:
Phoenix
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f12bd1412777/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f12bd14127772fc5ea920b39161f0c30fdf462bf9622b59eaafd7e8f1803156d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe f12bd14127772fc5ea920b39161f0c30fdf462bf9622b59eaafd7e8f1803156d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/206833/

Comments