MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 16


Intelligence 16 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
SHA3-384 hash: 663a489b6e35b08f5701d5a4f049c2bb5529bc4bcd8c353495bf802d6b14754663e64a1eaa018299494adc6590f703ef
SHA1 hash: 02670702f7c840e382edabab7933b5079112b2fe
MD5 hash: aba5cc62cc5479e1f5f5c733d750520a
humanhash: oxygen-beryllium-montana-river
File name:revised_invoice.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:848'384 bytes
First seen:2023-08-03 15:42:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:QEKaJFds+DAOBwjoe1qtWiRW95ZZUiGTrj4z1/c7:5dYjoeYWJdZvd/O
Threatray 212 similar samples on MalwareBazaar
TLSH T17405E73804780A12C136D2ADAAD4F513B3904F96711DCD5686C25FCA0AD6E2E2DDFDEE
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
323
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
revised_invoice.exe
Verdict:
Malicious activity
Analysis date:
2023-08-03 15:45:40 UTC
Tags:
evasion snake keylogger trojan
Link:
https://app.any.run/tasks/009a8029-178c-4586-b538-d0533fc930e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/440108/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2232.2982.10760.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Restart of the analyzed sample
Enabling the 'hidden' option for analyzed file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64cbcb0a9d051153de132c2c/reports/d9d29f0e-49eb-4174-9135-0b36387168a6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3d15632e-dd64-494f-a628-01364e09766a
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1285211
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1285211 Sample: revised_invoice.exe Startdate: 03/08/2023 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Sigma detected: Scheduled temp file as task from temp location 2->53 55 7 other signatures 2->55 7 revised_invoice.exe 7 2->7         started        11 VCYZNOqT.exe 5 2->11         started        process3 file4 33 C:\Users\user\AppData\Roaming\VCYZNOqT.exe, PE32 7->33 dropped 35 C:\Users\...\VCYZNOqT.exe:Zone.Identifier, ASCII 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmp654B.tmp, XML 7->37 dropped 39 C:\Users\user\...\revised_invoice.exe.log, ASCII 7->39 dropped 57 May check the online IP address of the machine 7->57 59 Uses schtasks.exe or at.exe to add and modify task schedules 7->59 61 Adds a directory exclusion to Windows Defender 7->61 13 revised_invoice.exe 15 2 7->13         started        17 powershell.exe 19 7->17         started        19 schtasks.exe 1 7->19         started        63 Multi AV Scanner detection for dropped file 11->63 21 VCYZNOqT.exe 14 2 11->21         started        23 schtasks.exe 1 11->23         started        signatures5 process6 dnsIp7 41 checkip.dyndns.org 13->41 43 132.226.8.169, 49695, 80 UTMEMUS United States 13->43 45 checkip.dyndns.com 193.122.6.168, 49696, 80 ORACLE-BMC-31898US United States 13->45 65 Tries to steal Mail credentials (via file / registry access) 13->65 67 Tries to harvest and steal browser information (history, passwords, etc) 13->67 25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        47 checkip.dyndns.org 21->47 29 WerFault.exe 21->29         started        31 conhost.exe 23->31         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-08-03 15:43:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6263uvk5cnlbnd37cwazjgvvzkgwwihjuzev4dh456gtweuwhcqa._file
Verdict:
malicious
Similar samples:
0671a83325b8542dc12228a28fcc62b71fb51a2a92463e3552ca7112783dc25f
SnakeKeylogger
5d06339335115891050ba9858ade0a01a1e11ac41ed8988c70953c3285d36121
SnakeKeylogger
8f22351f698d43ccb1a779b47b3b721d9ef4c346df9b0472c8dc05a53c8cf46d
SnakeKeylogger
9bb9b2de4a10d3870ec7fc4f2a2be8341c6e12cb2ae7a97d27adf246c674781e
SnakeKeylogger
c14657190bec0bf6b8fd9ef47563657948aa3ea66a43e7d0224c7662f323e144
SnakeKeylogger
cbe64315ecbd415dd086b2d0872865e5ecc033290ce157bf79d693864769ff8a
SnakeKeylogger
d143750fda26f7d51d271719c7206cac7015528a13a00faa4f35232dc1dbc63c
SnakeKeylogger
eab752432f60f4568a56559c449f891bfa3e3327da4f05e7c496c6d2573da409
SnakeKeylogger
f37044c7d35e640b023f3cdc034ad89cdd077a2e8967a9e62f887296faa57a93
SnakeKeylogger
fb6d0c9f8246ae9fafae10a3ed496220f6b2803e454a1da51f07a6dcda5df7b4
SnakeKeylogger
+ 202 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/230803-s5xceadh99/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger payload
Unpacked files
SH256 hash:
862f3cd524b29fc5b6ced9cfc4d13756cb90d6c95ca50fd2438e2d5df44bbf05
MD5 hash:
8ade068b8a62b6173f1d3e07bf0a7e04
SHA1 hash:
b63b1dddf4358e8826dab84e4206137d41718592
Detections:
snake_keylogger
Create hunting rule
Link:
https://www.unpac.me/results/bfc0a011-7aec-4b6c-abf3-1e19066582c3/
Parent samples :
6b9078cd23ba0a810bb971fde08fcbe3b4124c84846b7446ebaf7eac57da047b
db7f70227c9ba4a6977cbd919bf9aa2f611d2557b145e5a8d7f06d184dd9d5d3
d1e6c1aa5e9ba581f78bb0270c55f94dc5013f5d546ad2524efb6b005dce36e8
d2ed2fe66a89a05c02510dabf4360f8fe54f6f27e94ccd864c56beaf218229e3
14bc396bc52d43f2e370a4a65ad0b08012e48b0644ed66325848e0dafd195ce4
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059
d757716097082fdcf35033613d1736f4cf02f07afb368b1381489ba8ebba3cb0
48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/bfc0a011-7aec-4b6c-abf3-1e19066582c3/
SH256 hash:
b474fe5f7b2819ba3aa344a9d78c6f9b26acc39b1556dc3915bd9d1058ea5edd
MD5 hash:
be48f6fbdd914940131b156cbf7ed42c
SHA1 hash:
6dfb93557a1494edee34d4a2e09dcbac92086dea
Link:
https://www.unpac.me/results/bfc0a011-7aec-4b6c-abf3-1e19066582c3/
SH256 hash:
40821038dd9a8a0c85f1c5898dcdd8fac1499e0b569ddfbadffe1c6ceb0aa03b
MD5 hash:
71ff3a9613b8d58debedc2742c43def3
SHA1 hash:
17cc80f177b9baa3f97024e6c7606961aaf36e37
Link:
https://www.unpac.me/results/bfc0a011-7aec-4b6c-abf3-1e19066582c3/
SH256 hash:
f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0
MD5 hash:
aba5cc62cc5479e1f5f5c733d750520a
SHA1 hash:
02670702f7c840e382edabab7933b5079112b2fe
Link:
https://www.unpac.me/results/bfc0a011-7aec-4b6c-abf3-1e19066582c3/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f6bdba555d13/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_SnakeKeylogger
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe f6bdba555d1356168f7f1581949ab5ca8d6b20e9a6495e0cfcef8d3b129638a0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/440108/

Comments