MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f385b9d70786827c85dc35ed329fe7422b1c6e86960ed20c1b30b3435814f81e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 6
| SHA256 hash: | f385b9d70786827c85dc35ed329fe7422b1c6e86960ed20c1b30b3435814f81e |
|---|---|
| SHA3-384 hash: | 1bd28a14036c89f8a6481633254662f289dcd0b922693836c812a670c4efa26c1518604e8a43538fcef2bd2a6e905021 |
| SHA1 hash: | 36c363939703aec1d79f50457fed4cfe30807fd1 |
| MD5 hash: | 022d6d9c803690f6f53c655a86c69edb |
| humanhash: | island-michigan-network-kilo |
| File name: | INV09534567800087654.zip |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 233'617 bytes |
| First seen: | 2022-07-01 07:16:01 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 6144:yKh9BnKVhnY6wVcZR8XngG46z2Qsz+EXmBzDi:yKDB8bwmLAg9ztXADi |
| TLSH | T1FE34120F26824E4FDC198CF3B1963E8DDBB6275C508CB26792E6797DD742E443A8C816 |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  cocaman |
| Tags: | SnakeKeylogger zip |
cocaman
Malicious email (T1566.001)From: "tyconequipment@gmail.com" (likely spoofed)
Received: "from host.mm-online.ga (unknown [185.222.57.247]) "
Date: "1 Jul 2022 07:56:28 +0200"
Subject: "purchase Order-005"
Attachment: "INV09534567800087654.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
overlay packed packed
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Status:
Malicious
First seen:
2022-07-01 04:12:33 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
15 of 26 (57.69%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Snake Keylogger
Snake Keylogger Payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5476629412:AAGbkcFsGq72YxKoGZjVmRBskss9nHikjMc/sendMessage?chat_id=5594190904
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.