MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f656604538654dd3243b458789440e5a31b6a404cce9521ce9a4706039295012. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	f656604538654dd3243b458789440e5a31b6a404cce9521ce9a4706039295012
SHA3-384 hash:	0f3bd2f61dd4f65dc56d88bdfee3a271c12fa877ca0885eb1927fec5963e713e4ae64f7efda305fc630867368b0251ca
SHA1 hash:	118b27b97dcc044af0cd7c07540c034e207298c2
MD5 hash:	c59fc968f6d7b4d39d65de29b5685603
humanhash:	fish-fillet-four-avocado
File name:	DHL DOC 7465389.pdf.xz
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	517'293 bytes
First seen:	2022-05-12 05:26:56 UTC
Last seen:	Never
File type:	xz
MIME type:	application/x-rar
ssdeep	12288:lP6sPwSjyj0fKKFsoMABCtH5iMCZMYKJNu6NppiM4SIm:lisPpuj0f9FsoroIMCWNuV3m
TLSH	T1A5B42393EF94E9627FB188022767B7950DE7C590D5C2B900ECB8C22253C1B4EEB78B45
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	DHL SnakeKeylogger xz

cocaman

Malicious email (T1566.001)
From: "Notice of Arrival DHL <eyaluri@inter.net.il>" (likely spoofed)
Received: "from inter.net.il (unknown [45.137.22.42]) "
Date: "11 May 2022 17:49:59 +0200"
Subject: "RE: Notice of Arrival for AWB # 3406506482"
Attachment: "DHL DOC 7465389.pdf.xz"

Intelligence

File Origin

# of uploads :

# of downloads :

158

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control.exe obfuscated packed

Link:

https://www.filescan.io/uploads/627c9ab68d13de6dc3af3f67/reports/83364e18-5759-4e31-ac07-7b98c592b820/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f656604538654dd3243b458789440e5a31b6a404cce9521ce9a4706039295012/

Threat name:

ByteCode-MSIL.Trojan.Gorgon

Status:

Malicious

First seen:

2022-05-11 11:09:21 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 41 (43.90%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6zlgarjymvg5gjb3iwdysraoliy3njaeztuvehhjurygaojjkaja._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger stealer

Link:

https://tria.ge/reports/220512-f5efdaafa3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Snake Keylogger

Snake Keylogger Payload

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/f656604538654dd3243b458789440e5a31b6a404cce9521ce9a4706039295012

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research