MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 13

Intelligence 13 IOCs YARA 11 File information Comments

SHA256 hash:	f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7
SHA3-384 hash:	81e166c0396dc1e08f7007f24e63cbd75abb70d6f96943e1e220ba7b7d51fb753110435a086f39e7bf699e1e5b2b611f
SHA1 hash:	870d2c4d3358364a4a1833ca459a5ee768d9202f
MD5 hash:	3624095ab26bd8a117c70e7aa239a22b
humanhash:	kilo-queen-ack-lion
File name:	3624095ab26bd8a117c70e7aa239a22b.exe
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	641'024 bytes
First seen:	2023-01-26 07:44:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:iSkOvbnR8ey/ZhEXDCzFqIGz+2//MW5qroz031DXuyEZ2AWdXwYr:MvZXGz+5W5qwa161Z2A2z
Threatray	10'624 similar samples on MalwareBazaar
TLSH	T131D49D1023E89F44F6BE4BB896B9405213B7BC837573E25D8ED120DE4EB2B04AB45767
TrID	61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.1% (.SCR) Windows screen saver (13097/50/3) 8.9% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	7eeceeccd6c2f2f2 (14 x Formbook, 9 x AgentTesla, 8 x RemcosRAT)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

185

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ANNEX 3 - SECTION 4 - Remuneration-rev.1-part iv - Service Reconciliation36.1kB.doc

Verdict:

Malicious activity

Analysis date:

2023-01-26 07:38:51 UTC

Tags:

loader exploit cve-2017-11882 evasion trojan

Link:

https://app.any.run/tasks/ebf84230-70e9-45db-ba6b-350f4564e1c8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/357003/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Reading critical registry keys

Forced shutdown of a browser

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63d22f7f2b351a3d0ea8fe07/reports/09cd9f7f-194c-4358-b221-9714514cc04d/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6b37e32e-a080-4eef-963a-a02118a58859

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1159334

Signature

.NET source code references suspicious native API functions

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7/

Threat name:

ByteCode-MSIL.Spyware.Noon

Status:

Malicious

First seen:

2023-01-26 07:45:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

15 of 23 (65.22%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6y26heqm3xgn4hcjqhakjj4tglaqrqjetljuiio4ktm4gcuu2gtq._file

Verdict:

malicious

SnakeKeylogger

4f5ea72df2ff98979013fbfe0781a01d8d487d886ebc5012e037f553527996d2

SnakeKeylogger

6a9d3a6f928c5a2a9ab9abe269027f3b987045fbb30803dd431ae2f56d5f859c

SnakeKeylogger

8572c3b461f643bf5baaeb032cf81f83af78dcc60e34d98c669d12f748bb38f3

SnakeKeylogger

8878359c93d36d0849467e895c724bd5a171a4ac97f29217aca79645f3c57a40

SnakeKeylogger

8fc56654c730505dd97bbe04e8c9f688b7b9366eb1981e848fe3c829a553f40d

SnakeKeylogger

d943f08a35dc06253557151dbff927a9eb4c26f425d328cf612cb7e5211c3822

SnakeKeylogger

ef208a2f463e7c3b8ea5c01332d60d691018a27fb0baf080fb2b42bad34b1d07

SnakeKeylogger

+ 10'614 additional samples on MalwareBazaar

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/230126-jldxaaed7s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot5611396317:AAGsgxx4hwlHZa8kVodTZpCQipWRFwFvBO0/sendMessage?chat_id=5237953097

Unpacked files

SH256 hash:

54d781f0dee6692c47390edf1ada295fb17a7e80ed5ccd58ab14c6ddf80a0ad8

MD5 hash:

4f6caebd865502f7c8046fbae3284c61

SHA1 hash:

be357e832bf6f61454875b37a1759cf1c5fa5ca4

Link:

https://www.unpac.me/results/5fb14e79-b795-4d1b-8351-8f6d88817161/

SH256 hash:

411569f9f0b865c651adc1234d23f86cd98fe5cd641704702276e9882be113b6

MD5 hash:

7648892096f37af50468509c5b051180

SHA1 hash:

a56a074c2770152761f6c4975db0e9f7d57f8cda

Link:

https://www.unpac.me/results/5fb14e79-b795-4d1b-8351-8f6d88817161/

SH256 hash:

37fa7974e1b10166f60ebbf0d14522f31605caf825529d5dad0ff61b9c1a5798

MD5 hash:

c0f22544c7658e0075cd60d13ab50e08

SHA1 hash:

63a10ca1c29cb78112f6eb2f9ce0687e6a73ce23

Detections:

snake_keylogger

Link:

https://www.unpac.me/results/5fb14e79-b795-4d1b-8351-8f6d88817161/

Parent samples :

9cef746651b3dc0dc351663360dc8b614e4bd4d82b44ed13a212e988d2f3c072
97a21cdbe71ff0d84c423b4bc9a373a1de90c94ec7af9adc97a6d3812fdf2dfd
f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7
f6acf4d217145bc4c53e7e9b17046134b2afc502ba7ef0b7cd96d165b1602c3e
465ae47eaddb30a5c73bc629399fa34845f1ba18a8fc9e5a55765064b2910b37
ea46cc06d4376c90836299719c0fb4bdc65e8edfc9fa367d0daa3e7cd3e63e77

SH256 hash:

ff954479b1cea44a608a8f9c026b932cc58d5257d045f526d0e91c9847489dbf

MD5 hash:

58d1e4c8c33a05b4c63a2504c1ad2cf2

SHA1 hash:

35bdf0a6c45705eac61718bcfb15ff3ca886a839

Link:

https://www.unpac.me/results/5fb14e79-b795-4d1b-8351-8f6d88817161/

SH256 hash:

401782c07b14e505afd1a34986d53d12b54fe91f1abb2003e44ab3e2c52a77be

MD5 hash:

b028983de03d7c77436658ea69544473

SHA1 hash:

04bbba9af8302dbe1d56b8689a08fd1d7276e4cf

Link:

https://www.unpac.me/results/5fb14e79-b795-4d1b-8351-8f6d88817161/

SH256 hash:

f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7

MD5 hash:

3624095ab26bd8a117c70e7aa239a22b

SHA1 hash:

870d2c4d3358364a4a1833ca459a5ee768d9202f

Link:

https://www.unpac.me/results/5fb14e79-b795-4d1b-8351-8f6d88817161/

Malware family:

SnakeKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f635e3920cdd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook Create hunting rule
Author:	ditekSHen
Description:	Detects executables with potential process hoocking

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_SnakeKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects Snake Keylogger

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnakeKeylogger

exe f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2283634/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/357003/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample