MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb3c26c5cb9cd103cf03cbf61c27d691876bfd2be000f1b0cd74d496de9f35ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb3c26c5cb9cd103cf03cbf61c27d691876bfd2be000f1b0cd74d496de9f35ba
SHA3-384 hash: 8928c0ddcc6884e0e30c8e1da2137f653e013b9db4daf9b28ebe628e437f36c22d687decc5b06636bfa25ef929de3f20
SHA1 hash: fa87b7e89f1c4f1d7b25b4223c8adb5e06364db4
MD5 hash: b5a269e25321e2ecbf9a5ca0574c8505
humanhash: october-mississippi-nine-double
File name:ziraat bankasi swift.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:405'504 bytes
First seen:2021-11-12 08:33:51 UTC
Last seen:2021-11-12 12:23:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:uilzDQE2iNrqg5pTnS2eQxBYVOB9SyDJRk70A6ddnhNxc:XDQE1BvnS2BLB9SMJZ
Threatray 1'615 similar samples on MalwareBazaar
TLSH T1E1848C9C725075DFC827CD778AA82C64AA2064BB971BD217A05711EC9A0DBDBCF106F3
Reporter abuse_ch
Tags:exe geo SnakeKeylogger TUR ZiraatBank

Intelligence

File Origin
# of uploads :
2
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205205/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/618e27033edf00a722d00707/reports/4a77ad2b-7d6e-49a3-ae4e-e88100b545a0/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c023f852-6fc6-4adb-9440-e0a91d398a97
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/887964
Signature
.NET source code references suspicious native API functions
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 520435 Sample: ziraat bankasi swift.exe Startdate: 12/11/2021 Architecture: WINDOWS Score: 100 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 8 other signatures 2->25 7 ziraat bankasi swift.exe 3 2->7         started        process3 file4 17 C:\Users\...\ziraat bankasi swift.exe.log, ASCII 7->17 dropped 27 Injects a PE file into a foreign processes 7->27 11 ziraat bankasi swift.exe 2 7->11         started        13 ziraat bankasi swift.exe 7->13         started        signatures5 process6 process7 15 dw20.exe 22 6 11->15         started       
Detection:
snakekeylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fb3c26c5cb9cd103cf03cbf61c27d691876bfd2be000f1b0cd74d496de9f35ba/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-11-12 07:07:10 UTC
AV detection:
11 of 44 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7m6cnrolttiqhtydzp3byj6wsgdwx7jl4aapdmgnotkjnxu7gw5a._file
Verdict:
malicious
Similar samples:
0a80c9ca740f88fbdc0548e6cbf120dc03ee2ff243f610a1f7cc84de494f20bd
SnakeKeylogger
11f9fb92c34ae4431fd9715fc67b82ea29489135316105606cffe05944f3c476
SnakeKeylogger
12abc910bd5a6a05cdc8f1c94cc6a1968581850612c404267d63e77852cb4a90
SnakeKeylogger
222543cf9b75b95cc7c6e6f8252d2c205da8c9ec8d9c9587c19f1350b79f9dd3
SnakeKeylogger
2dae35b2c81440f320d907e58c7f331b08eff44f9803c796ea7deb1c53b5e145
SnakeKeylogger
3582856a25a8c10ed96e2ba53528ce32672f94e16cb93fb8160cc91be519e9d5
SnakeKeylogger
39a4ef63eed3420e394a7b9c0afd387ec27c4f70e1d293d2fe596ff3bf5ccd53
SnakeKeylogger
8e2a4b1e4cbecbe4f157cc6edda64c32b856fb53cb3c265c4d49175d597b7541
SnakeKeylogger
a82999d77adbff10ef701a595d165547fb73bf055dcae9b65d261e4d09c47654
SnakeKeylogger
b182edb787d497eeed41880c81331d9dee8ddfa00813672bc77f7b09a2528981
SnakeKeylogger
+ 1'605 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/211112-kg4gtahhgp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Snake Keylogger
Unpacked files
SH256 hash:
bd4c4912209802bb457983177d94b220d20dc9775ff973f90bd1c6afd729bc9c
MD5 hash:
8cde05c2cc918a68b075bdb2854c9994
SHA1 hash:
bc3c4e2826370171102ee8b7bd317493cd72c15f
Link:
https://www.unpac.me/results/a3940dac-6614-4bd2-9dc3-fab77c01acdf/
SH256 hash:
28eae50457cc7d08666a40723f1f2adb8548108a648f6e114e76cb4a2309ad52
MD5 hash:
aa18c739374bcdee13ca16f2b9518040
SHA1 hash:
bafcee4e242d96649b65d70f6f9694f63e919c7b
Link:
https://www.unpac.me/results/a3940dac-6614-4bd2-9dc3-fab77c01acdf/
SH256 hash:
cef191fc70f15f934d9d358348eeab92d4fecba532694085be35623ae3fae26e
MD5 hash:
f5b91d0898542dbf5ef76bf9c467b2cb
SHA1 hash:
3bae6a73583bc36d25fb73268f6fb1285e38333b
Link:
https://www.unpac.me/results/a3940dac-6614-4bd2-9dc3-fab77c01acdf/
SH256 hash:
fb3c26c5cb9cd103cf03cbf61c27d691876bfd2be000f1b0cd74d496de9f35ba
MD5 hash:
b5a269e25321e2ecbf9a5ca0574c8505
SHA1 hash:
fa87b7e89f1c4f1d7b25b4223c8adb5e06364db4
Link:
https://www.unpac.me/results/a3940dac-6614-4bd2-9dc3-fab77c01acdf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb3c26c5cb9cd103cf03cbf61c27d691876bfd2be000f1b0cd74d496de9f35ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe fb3c26c5cb9cd103cf03cbf61c27d691876bfd2be000f1b0cd74d496de9f35ba

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/205205/

Comments