MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
SHA3-384 hash:	7fd6b3c8b701d3f53aa96192d57a373188db5418f0e6bda8c2d4bc50f7c83cfd5e69a16beaff3dae4eed4c6fc819d4ec
SHA1 hash:	cbbe6381a0292f69bab951edd849fb713d4f76b2
MD5 hash:	0390281aa6bea2fccb424eec15cc7e78
humanhash:	autumn-arkansas-virginia-comet
File name:	SecuriteInfo.com.Win32.TrojanX-gen.20502.12077
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	790'528 bytes
First seen:	2023-12-25 08:13:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:dJpHCmbiNIwPt2gBpD1tM2MH6YZLuKw3WDJV733EgpAUBXvlL/bD9x7DW:ZCFPtBpD1tM2MTZLE6/l
Threatray	5'916 similar samples on MalwareBazaar
TLSH	T10CF46A4167D4CB2EEAB20235F9725134DE36F99A2816C75F705C712E2F72B148E632A3
TrID	60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.8% (.SCR) Windows screen saver (13097/50/3) 8.7% (.EXE) Win64 Executable (generic) (10523/12/4) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	0b1939694d4d6923 (23 x SnakeKeylogger)
Reporter	SecuriteInfoCom
Tags:	exe SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

420

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox Snake

Detection:

Snake

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/469288/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.20502.12077.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Creating a window

Query of malicious DNS domain

Unauthorized injection to a system process

Forced shutdown of a browser

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control lolbin msbuild packed regasm

Link:

https://www.filescan.io/uploads/658939cbf4b6e5e16358a764/reports/ce3c71fe-e0ea-43fc-aacc-553fd6ae10fd/overview

Hybrid Analysis Strictor.Generic

Verdict:

Malicious

Labled as:

Strictor.Generic

Link:

https://www.hybrid-analysis.com/sample/ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Snake Keylogger

Malware family:

Snake Keylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ef580091-f12f-40ef-a58b-c96db1de96e1

Joe Sandbox Snake Keylogger

Result

Threat name:

Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1366847

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeyLogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeyLogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-25 06:24:50 UTC

File Type:

PE (.Net Exe)

Extracted files:

16

AV detection:

23 of 37 (62.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=75uqmoj7rettmqzns5tmlvidqvpkscpiczjejzsbvkmg2yltoziq._file

Threatray malicious

Verdict:

malicious

Similar samples:

13f500cb766e4c37869fb3286cbefb2c2ecefb4a799ef7e5723f574a842d5647

SnakeKeylogger

2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b

SnakeKeylogger

545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d

SnakeKeylogger

71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118

SnakeKeylogger

becd887276df85a4eea5b2837327ee6eea59f0f7579f7894a8307e4681b9b5d4

SnakeKeylogger

+ 5'906 additional samples on MalwareBazaar

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/231225-j4zlpshefn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

UnpacMe snake_keylogger win_404keylogger_g1 MAL_Envrial_Jan18_1 MALWARE_Win_SnakeKeylogger INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_EXE_DotNetProcHook INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unpacked files

SH256 hash:

2e3cd624ab8ef282572cf0f4364fd9c1e7adc230d55421245c4e093bf38d2411

MD5 hash:

0b711150f739a59738faf8a85ce04ec0

SHA1 hash:

e7f643ac02230c1bc30b994f77324fb43d1ec3f0

Link:

https://www.unpac.me/results/a5d01dbe-1a38-457b-83c5-ef655e681bf5/

SH256 hash:

45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b

MD5 hash:

fb1bc19121c4e190d83672bc71b493f0

SHA1 hash:

c3488b969ba578e28ee360be24b6416425a224a0

Link:

https://www.unpac.me/results/a5d01dbe-1a38-457b-83c5-ef655e681bf5/

SH256 hash:

310b20a5abed2bdd0c8ad7596ff8ae46e6332c356762c71ba6fdf30f813b2071

MD5 hash:

a80bdd93bc7e526ca5e37ab3ab31b3e8

SHA1 hash:

31d916ab6e920790f7f3655e7c54930a0ccade57

Detections:

snake_keylogger

Alert

Create hunting rule

win_404keylogger_g1

Alert

Create hunting rule

MAL_Envrial_Jan18_1

Alert

Create hunting rule

MALWARE_Win_SnakeKeylogger

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Alert

Create hunting rule

Link:

https://www.unpac.me/results/a5d01dbe-1a38-457b-83c5-ef655e681bf5/

Parent samples :

2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b
71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118
f0df0ec243153f35a5522715fb79c372fde175ad98596185ec2eea5a16a535bf
f63b61933ecd47ebf5c5c79fb5e30c89852dc271dab0a6df17015392e1158293
545fdb2bead293870dcb77140221b96569378fb0be6a9f0aa824db3b568c267d
becd887276df85a4eea5b2837327ee6eea59f0f7579f7894a8307e4681b9b5d4
13f500cb766e4c37869fb3286cbefb2c2ecefb4a799ef7e5723f574a842d5647
ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
fd3215fd4bcb33f2149cd4bed63011c2b992b5a008cdd289559031741e8a3089
43a5ebb280e2770fe10bbb4e598c80456f8fd86b720cf50ecef20d7fbc1423b6
7eebc8928fee351d731226a9abbf7ce6e5833072b18721c603573fc8ff4c6e16
aa733006f49afe10de1ea472aba0b3e8e8192bc59d3a3b244d6953d493e57be9
4e8b17d34495b7e4397939448da55c81d186794fa6a1f00a5e3cbd4659dd74ac
b2ca317d8e7369cd7f839b2db7df1e53b7535ae432ce247e933e8dfa8917e3f5
409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5
dc13c362ff576c7b7733c08175dd2f581ffd40aeb8b090823c18f04ece12ca01
576ca0fbe491aadd6c66a937af35e94d616d9dd9c079b3c7c617fa25b7010700
38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f
d805b874ab77c6272e89f57f5b6f080b039f42064a85778a7ff4bf436575cf68
6a3eefff7806a0b03f089f6b53f17a1db9b6de86cb5c28c798a1b5244fbe7aa8
6eeb98a459b751958852c0072505e5d187b5473759dca00ef259065c914332a3
8e84d73c7aad92d849e23543da0276e3a1abb8e7c8ea46197bcc01f7b7c4662d
1af4b1e67dee34e1ce541150c83e1be4f75766d47ecebf4b476cb08aa04fa837
5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370
4c91634a53fddb78f1737e66c0c323cdbc8d2e720a14732b8336e449ce062319
8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9
7a66c663f71aff27ef5671579fd986b30c9527e23da7cbcfe7cdad8bf8baf739
4cb94e5cf28dc29ec74d5171838ec3735632812576708ec1bf1654b87b18215e
7dca5662fe7621ffd890ac202dd50e9d22b8f2ca186490ad62d8813cc0727cdb
dd2bb6ea65c082f25a75158f22c2d10e3be1daa026334a8d8e06007bbd245f70
b8410c46b62f3f4fa0255c4fa37c4899f2fa7ee69883d35bd178e629e2db24db
d85b912c5171741966d6c8238db04de39b56ed1b696ccf7a32400d34cd29338c
66b79b9bbc034503f2c6330157047506b561d119031d0dd9d03ff87153e01ec5

SH256 hash:

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651

MD5 hash:

0390281aa6bea2fccb424eec15cc7e78

SHA1 hash:

cbbe6381a0292f69bab951edd849fb713d4f76b2

Link:

https://www.unpac.me/results/a5d01dbe-1a38-457b-83c5-ef655e681bf5/

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ff6906393f89/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/469288/