MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9bd994b0826622daf7a05f6afd563ce7c9e0c4ea5fbe06aa9b0fe7d68c95d21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9bd994b0826622daf7a05f6afd563ce7c9e0c4ea5fbe06aa9b0fe7d68c95d21
SHA3-384 hash: 531c63e786c75299b5fc721547ea524504e3c684fc7d9cfcc3cb816cadbee0d67cfdb494afb3ab4d4f3880629b11903a
SHA1 hash: 5e3ac421d7844dba0d01dcaaba5cbf775f6394c8
MD5 hash: 2a804a0d7e7704e9c604d1a602de7b97
humanhash: winter-washington-lactose-five
File name:PO-3081 OMC-PO-308122-OMC INDUSTRY CO.LIMITED,pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:409'600 bytes
First seen:2021-11-11 16:30:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:4ZHTtD00xIQkGqqNiGKPxkYMmGwfuNc9:UTC0nJNM+mGau29
Threatray 2'730 similar samples on MalwareBazaar
TLSH T1EC94F1363FA8DE06C2374636CCEED06003FC78166962CB2A7FD8639E6D527909C5165E
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205047/
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILZilla.9529.29161.2081.UNOFFICIAL
Create hunting rule

Win.Packed.Msilzilla-9907552-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/618d4547a00afa9663a42835/reports/d4bd9e20-3305-483e-880d-71f4bded6748/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d3b1acbd-45df-4b9f-bb16-113be6de1dfd
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/887594
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
snakekeylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f9bd994b0826622daf7a05f6afd563ce7c9e0c4ea5fbe06aa9b0fe7d68c95d21/
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2021-11-10 10:04:51 UTC
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7g6zssyiezrc3l32ax3k7vldzz6j4dcoux56a2vjwd7h22gjluqq._file
Verdict:
malicious
Similar samples:
0e826d9174ddb2554e1c7a78ee145a3348660256269716d15e9c5f1a4c8f01c7
SnakeKeylogger
29175b21396cfe5c81cb4440506fab650ecc7d9fe8b7fd8166183e8df6711c55
SnakeKeylogger
2e3922c27678dd45b3cd465428d19c62a84cf8d242b8712919de61349eb5775d
SnakeKeylogger
332eb007a5e9b3e603bcd8546505d6df1b480ab032f772f5a24730c4cc6edfc5
SnakeKeylogger
3e22ce49e987a1d097778730877bd196bca1182772dbce70d75e109e1ed64702
SnakeKeylogger
76027f253ef7f7754a5813d939e23abaf53fe4bc4478d3f80bd09eada7419a49
SnakeKeylogger
765fa2e7b82c623817ae60faa7c21ff5cd5b06d242b2195a6644f73d4fab482f
SnakeKeylogger
7e64709cb86a58132d712f270d5672cd189bac61209b5ea91bda06ef57b27f38
SnakeKeylogger
df623c9ac537de8028b61717582bf71ee72949fc825da23c1167889454980f4b
SnakeKeylogger
f134314069aaa01fc01863ec536c8d47176522b1edd35b971a0d0ed4b3623b3b
SnakeKeylogger
+ 2'720 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Link:
https://tria.ge/reports/211111-t1cymsbfc3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Unpacked files
SH256 hash:
91655863c7906a8d20c7c782144f553c027843a72f2fdab2b1ccc80808083af0
MD5 hash:
b5044dd0e9c91b1a9185d491da7d07f2
SHA1 hash:
a9ff8129771d85f77b6a145f750c70e53f51125e
Link:
https://www.unpac.me/results/4881e8e0-ecdb-48ea-a9dc-6b55e4ec7d64/
SH256 hash:
0e68c63febbd4fbe1fcbcb7611b873332f1d3f344f30e6f51e6fa0b30816484f
MD5 hash:
fb8fd17307c2dd45e856012847632d6f
SHA1 hash:
73734437f354957bc2ba68c9007ac386e50a44f5
Link:
https://www.unpac.me/results/4881e8e0-ecdb-48ea-a9dc-6b55e4ec7d64/
SH256 hash:
3cc051e8214abb1e59f073cfe914eb57fcf92ed58a3397ab37ce6402be56ae5e
MD5 hash:
ca78863a921b0c28796adde20f5bbbc8
SHA1 hash:
26d972b1509b7ada090940db05512824c5421f71
Link:
https://www.unpac.me/results/4881e8e0-ecdb-48ea-a9dc-6b55e4ec7d64/
SH256 hash:
f9bd994b0826622daf7a05f6afd563ce7c9e0c4ea5fbe06aa9b0fe7d68c95d21
MD5 hash:
2a804a0d7e7704e9c604d1a602de7b97
SHA1 hash:
5e3ac421d7844dba0d01dcaaba5cbf775f6394c8
Link:
https://www.unpac.me/results/4881e8e0-ecdb-48ea-a9dc-6b55e4ec7d64/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/f9bd994b0826622daf7a05f6afd563ce7c9e0c4ea5fbe06aa9b0fe7d68c95d21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/205047/

Comments