MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3761ed191aeddf0e23bba17e361229d81547309dac3b451202df849083b7916. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f3761ed191aeddf0e23bba17e361229d81547309dac3b451202df849083b7916
SHA3-384 hash:	7a4304b1e5c5bbedce0089486a194d5763297a4589d68d8328e938ff7166b92659bdc355a7cadea29524d1f55f89b7a5
SHA1 hash:	0dbe1f2b08510b57f0e00189d2355f57e300c47f
MD5 hash:	bac652fa9a932e3f71411fb993010377
humanhash:	hamper-floor-georgia-timing
File name:	na
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	119'233 bytes
First seen:	2024-10-06 18:41:12 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	96:Ea+M73mAWZeuhtAWZDuhogROBHRj/oyYJQAWZSAWZXuhdAWZkAT:Ea+Q3mVkuhtVVuhhRwHxY+VgVFuhdVZT
TLSH	T111C3956AED348CDDBBCC8AD3B3FCA0C8365D635B536A1FD245973849E9A176C50C0624
Magika	txt
Reporter	abuse_ch
Tags:	hta SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

108

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6702dab0ebeac9e6805114f7

Tags:

Powershell Autoit Gumen Snake

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/f3761ed191aeddf0e23bba17e361229d81547309dac3b451202df849083b7916/results/dashboard

Payload URLs

URL

File name

http://172.245.123.6/230/taskhostw.exe

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/6702d9fe4e70868f15d5e635/reports/a1257390-d86c-4657-a2d5-40975615890d/overview

Hybrid Analysis VBS.Asthma.2.C52E430B

Verdict:

Malicious

Labled as:

VBS.Asthma.2.C52E430B

Link:

https://www.hybrid-analysis.com/sample/f3761ed191aeddf0e23bba17e361229d81547309dac3b451202df849083b7916

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Hidden Powershell

Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.

Joe Sandbox Cobalt Strike, Snake Keylogger

Result

Threat name:

Cobalt Strike, Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1527198

Signature

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Detected Cobalt Strike Beacon

Found malware configuration

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Yara detected Powershell decode and execute

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f3761ed191aeddf0e23bba17e361229d81547309dac3b451202df849083b7916/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Snakekeylogger

Threat name:

Script-WScript.Trojan.Snakekeylogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-10-03 05:38:37 UTC

File Type:

Text

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6n3b5umrv3o7byr3xil6gyjctwavi4yj3lb3iujafx4escb3pela._file

Threatray unknown_loader_036 admintool_powerrun snakekeylogger 404keylogger

Verdict:

malicious

Label(s):

unknown_loader_036

Alert

Create hunting rule

admintool_powerrun

Alert

Create hunting rule

snakekeylogger

Alert

Create hunting rule

404keylogger

Alert

Create hunting rule

Similar samples:

error

SnakeKeylogger

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger collection defense_evasion discovery execution keylogger stealer

Link:

https://tria.ge/reports/241006-xd2v2azblk/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Evasion via Device Credential Deployment

Snake Keylogger

Snake Keylogger payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f3761ed191aeddf0e23bba17e361229d81547309dac3b451202df849083b7916