MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fb2fd5d1cd31c753b74ea5d3b372cf96e6e4f9c520c31dd2d14ef17bdf965d3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 7
| SHA256 hash: | fb2fd5d1cd31c753b74ea5d3b372cf96e6e4f9c520c31dd2d14ef17bdf965d3f |
|---|---|
| SHA3-384 hash: | 4e49cb14ff380a236e22d4da488128bfca780f8c9d6b37c1ea5d66c39d562a6cd3ae4c5771be8be16e8522a19e4d58db |
| SHA1 hash: | a459ce98c8dcb44f82ea1d7119900e007d00995e |
| MD5 hash: | 3da3ccb28050e4df36b319775cbe283e |
| humanhash: | red-blossom-batman-emma |
| File name: | 3da3ccb28050e4df36b319775cbe283e.exe |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 529'716 bytes |
| First seen: | 2021-09-22 05:45:06 UTC |
| Last seen: | 2021-09-22 07:14:26 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger) |
| ssdeep | 12288:lBSD0ty7vGYaj4Zs2ctfllgiJglkjuGxRwddb20MXzF5uwn3J:nSDd8gs2ggsgS/x6boJ5NJ |
| Threatray | 1'091 similar samples on MalwareBazaar |
| TLSH | T1E6B423D693539D73C5A5A7B002B3B7F9FBBDC3D2001494974FE09E386993A839905782 |
| File icon (PE): |  |
| dhash icon | 64f4d4d4ecf4d4d4 (82 x SnakeKeylogger, 34 x AgentTesla, 24 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | exe SnakeKeylogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal WLAN passwords
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Downloader.Conjar
Status:
Malicious
First seen:
2021-09-17 05:42:28 UTC
AV detection:
14 of 45 (31.11%)
Threat level:
3/5
Verdict:
malicious
Similar samples:
+ 1'081 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Looks up external IP address via web service
Loads dropped DLL
Unpacked files
SH256 hash:
4a8080d6ebb136ce6b049f9fe7872e164b0266309f4ee8cb610b950b4df727df
MD5 hash:
35aa711c620fc22debb06e38cf761403
SHA1 hash:
7f49427a7f0ceafce19a6dd485ed6d71a0e986eb
SH256 hash:
8c20efa7840ea46890925c316626e0aa671a4e7d249de69407a5274493a6e4a5
MD5 hash:
2dd50ff90ccb59e98fef5053754630e7
SHA1 hash:
fa47ab78b33e75c7be8c1ad3c55d94efa54efa29
SH256 hash:
fb2fd5d1cd31c753b74ea5d3b372cf96e6e4f9c520c31dd2d14ef17bdf965d3f
MD5 hash:
3da3ccb28050e4df36b319775cbe283e
SHA1 hash:
a459ce98c8dcb44f82ea1d7119900e007d00995e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.