MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685
SHA3-384 hash:	687f04c362f935074b65043ab2ae357b6c4a59d84d4525d7da055da6d351c63f77c2e88cf531904ac023359010d0d290
SHA1 hash:	c86543d3797d611922afa5fec100c985df0e3fce
MD5 hash:	11a6161eb8cb335885badc7514dba6c2
humanhash:	december-jersey-india-ceiling
File name:	RFQ___FL.EXE
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	791'040 bytes
First seen:	2021-07-02 08:41:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:5ml5MOXSx4x3p4H0WlomgKzhyZtoSHarka2dZEniI/fEzJ9mXrQu1uKT35x45H7l:g0nrg6hD6/AnEW
TLSH	75F409683A9070AED4B7CA77CAAB2C58EAB9B437571B550B601302DDCB0D943DE701B7
Reporter	cocaman
Tags:	exe SnakeKeylogger

Intelligence

File Origin

# of uploads :

# of downloads :

131

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

RFQ___FL.EXE

Verdict:

Malicious activity

Analysis date:

2021-07-02 08:43:32 UTC

Tags:

evasion trojan snakekeylogger keylogger

Link:

https://app.any.run/tasks/8c23181e-d774-44ea-bf51-d0bf109201f0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Snake

Link:

https://www.capesandbox.com/analysis/169304/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.899-1.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/89fa3097-f47d-4b05-a00b-72f5981419c9

Result

Threat name:

Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/810977

Signature

.NET source code references suspicious native API functions

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM3

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685/

Threat name:

ByteCode-MSIL.Trojan.Taskun

Status:

Malicious

First seen:

2021-07-02 06:12:26 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

14 of 46 (30.43%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7dsmp5kibvvtalsiodfj5mubddxepxinvvfwrfcqpaw7zzj3q2cq._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210702-5dwgen7tye/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Unpacked files

SH256 hash:

1c5e0a0d909d1da24af87967a1e154c8aa490a1f99c6624e7214d20eb84f4fec

MD5 hash:

81faf15c7e3c9446d906659f7c7a9f16

SHA1 hash:

d7e05a22b109ce608109dc509029a7fe22b4b8bf

Link:

https://www.unpac.me/results/2eaace67-91bd-45ed-bf54-e5820e47090b/

SH256 hash:

4f01773b5108b0cd38d51b897e85645c7e0ec5c089d1fd03bf4e800e10790f65

MD5 hash:

6805fcc695d88f9d1fe36241eef41935

SHA1 hash:

5a70cc18b45452bec032f1f04409cf64bc3fe741

Link:

https://www.unpac.me/results/2eaace67-91bd-45ed-bf54-e5820e47090b/

SH256 hash:

5661c575031aaaf62d41ad8e0343471dfb1392af8effe1c1cc38a3c5e9d5397a

MD5 hash:

6af6e643b4e64c8fd4e5f4e0431ca9f8

SHA1 hash:

0aeb28f233856b5172b74f893043f436fc959326

Link:

https://www.unpac.me/results/2eaace67-91bd-45ed-bf54-e5820e47090b/

SH256 hash:

f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685

MD5 hash:

11a6161eb8cb335885badc7514dba6c2

SHA1 hash:

c86543d3797d611922afa5fec100c985df0e3fce

Link:

https://www.unpac.me/results/2eaace67-91bd-45ed-bf54-e5820e47090b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.