MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f487cf6d998c562d6d43424c23df0d8648860e77a37c1bd0403a63833ee12cff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments 1

SHA256 hash:	f487cf6d998c562d6d43424c23df0d8648860e77a37c1bd0403a63833ee12cff
SHA3-384 hash:	1f3fc66e50157e11d1bb50e06c8b795ea8b9e514d775ff8cc1a617bb6b5b7d19e01715eb615a25100a76e309b0079df8
SHA1 hash:	3d88b7debca8369a982d5ce6ec2b3ab50c360520
MD5 hash:	920b705e86bffeb6e7ef6ba8cdf17cfe
humanhash:	salami-grey-oklahoma-music
File name:	920b705e86bffeb6e7ef6ba8cdf17cfe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	1'153'024 bytes
First seen:	2022-11-09 03:31:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'628 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	24576:CsE1K8DJKM4cSqxJ9bhwKkAg+Frw2+JOHG9We+SqrhvvGG:REBJHTJ0hAg+FreOm9n+SqrhvvGG
Threatray	8'395 similar samples on MalwareBazaar
TLSH	T1B135E0213274DB17E0BA97FA653164A00BBE7E96692DD6281DD039DE0A33F414F18F63
TrID	64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13097/50/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter	zbetcheckin
Tags:	32 exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

174

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

konut katalog..doc

Verdict:

Malicious activity

Analysis date:

2022-11-08 15:41:00 UTC

Tags:

exploit cve-2017-11882 loader evasion trojan snake

Link:

https://app.any.run/tasks/c3a7e6f0-ad6a-4e06-ac2f-cde3977b27b8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/330942/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/636b1f3582dd9f2e26531639/reports/b698190f-93c7-4a9a-b6f4-2ea1746b8c17/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/91114ea5-6960-4cc6-9e36-6f9d9a335f37

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1108891

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f487cf6d998c562d6d43424c23df0d8648860e77a37c1bd0403a63833ee12cff/

Threat name:

Win32.Trojan.SnakeStealer

Status:

Malicious

First seen:

2022-11-08 18:18:41 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 40 (45.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6sd463mzrrlc23kdijgchxynqzeimdtxun6bxucahjrygpxbft7q._file

Verdict:

malicious

SnakeKeylogger

406e9f07aa3bb42bcc51aab336b1a672de5abb220416451cdebc0916cbb45396

SnakeKeylogger

73493f393423de3502be624402e63b53216a91ec15cb5ab1357661a75c2ad29e

SnakeKeylogger

775bfe71cc319661eab3324221ff8f507df0f88dc7062133faa70c0e1969a69c

SnakeKeylogger

8e4ee0ec7d1ac518e6f583d03c62b7d89978f2a0df7f5d1e50e709fe7a91a512

SnakeKeylogger

9b99bfeaca81fa2a9b5f525bd35d6f7f87866a65970f3fcde51085401e51e4d5

SnakeKeylogger

cc59aa1e7c1791f184e0725ba1e86bfe1d636761bd640aed519e1eb1c81161b1

SnakeKeylogger

d85e746a22444825e6140beed538bf5ffd680b30c2458f68605a4b1efc58b591

SnakeKeylogger

+ 8'385 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/221109-d3l2bsddc7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Unpacked files

SH256 hash:

cc7f3c43450bb1d3b50448a4fa64c2cd2fd872f3fdc37faa9ab63acc7b3acfda

MD5 hash:

6f6987566d6062083ed5bff05a9505b2

SHA1 hash:

7298debca20f90fe641b5860b7cee8d8a8415d77

Link:

https://www.unpac.me/results/6657ba89-1f5a-493a-ba92-efc8be435811/

SH256 hash:

cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4

MD5 hash:

aabd0bdc81026ade6c57383f21d5c227

SHA1 hash:

4b26936bb8c03be6d7963184215a5ab594ecb765

Link:

https://www.unpac.me/results/6657ba89-1f5a-493a-ba92-efc8be435811/

SH256 hash:

92bd802a0f7eb1213758a6c1a4c07302e0320c3a2aeb6273b0303dd3bbdefe90

MD5 hash:

046e97119545e5abde2f40b5dc3a0344

SHA1 hash:

3e69b67ddff2554c8cd72e129d4da9c8acd9d331

Link:

https://www.unpac.me/results/6657ba89-1f5a-493a-ba92-efc8be435811/

SH256 hash:

28dca92dd5505a3fafa70b99642539a955d4e6a4e91dd7ecd75318732ab2de4a

MD5 hash:

0a21fdc70dcb5982dbb3ec9a6b578a58

SHA1 hash:

39c0853b1f2e2a9186e8e2075452ae66a28d0d5f

Link:

https://www.unpac.me/results/6657ba89-1f5a-493a-ba92-efc8be435811/

SH256 hash:

e9a3e38d442e3cee67822711010c674a3f93e5ed41cfe89f2a746f23fed610e3

MD5 hash:

dae09a807be4fa2e8424239d4342bcaf

SHA1 hash:

0e7be1d92404a97630717dcf5416fa81babc9782

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/6657ba89-1f5a-493a-ba92-efc8be435811/

Parent samples :

f487cf6d998c562d6d43424c23df0d8648860e77a37c1bd0403a63833ee12cff
5858f01bcc7b7e57d7705e26201eae641421dee20244d1a40005123938e6216c
11ba879203691cf383e6600a3812019bc3a9dd5da7643ace3e0168fd6d3f546f
cd3a8a30fab5929fb0c75fc80d28025ae10a7ccba84580cbcd2716636461091f
9cd955e380100a54a716efea7e45deae67ee297740b62fd4b379de11b0934243
4640e238a1ebec4c1eb753c7c81e682a4b2d231322a9583797a512d7261b2d89
ad685db8c0a4dab90ebbd009ad5df9208b1ad93ea8d9773f30542cc7e64377bb
fe0acab9e7af19546f5b9092a35045fab873846ea0d53083e07f7a563dad7f01
1223358fd47406217b3fde5b7eacab6ae5bff40a0c40fa4f5301f221ec7182d6
3a8df9a13c2c8a594bc50931d2d87d4319d258e567f1c05eec1375fce98663c9
07cce5afdb262e566c2f49b305e87949c0e9ffd746ff1ad77aeb103a7e1a0bfa

SH256 hash:

f487cf6d998c562d6d43424c23df0d8648860e77a37c1bd0403a63833ee12cff

MD5 hash:

920b705e86bffeb6e7ef6ba8cdf17cfe

SHA1 hash:

3d88b7debca8369a982d5ce6ec2b3ab50c360520

Link:

https://www.unpac.me/results/6657ba89-1f5a-493a-ba92-efc8be435811/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Password Stealer

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/f487cf6d998c562d6d43424c23df0d8648860e77a37c1bd0403a63833ee12cff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

exe f487cf6d998c562d6d43424c23df0d8648860e77a37c1bd0403a63833ee12cff

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2259319/

Cape

https://www.capesandbox.com/analysis/330942/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-11-09 03:32:22 UTC

url : hxxp://208.67.105.179/yugozx.exe