MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4300b04da881e72e48c41cbcce73da7472580f3095bd0783ffb638c3b8e3a489. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 File information Yara Comments
Add tag Delete this sample Report a False Positive

SHA256 hash: 4300b04da881e72e48c41cbcce73da7472580f3095bd0783ffb638c3b8e3a489
SHA3-384 hash: 9adb57016b14fcdcb84ef739ec5776b62e30cd724968ecc927ebe3c75c35da5b404c14bec24a2924a8e7604a8a0c4c7f
SHA1 hash: a690813c0a5f42ac02617f064eebda22066226ec
MD5 hash: ef169806e83e8c370dba1dc008df9eed
humanhash: hot-enemy-river-shade
File name:Halkbank_Ekstre_20210223_082357_541079.img
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-23 07:26:55 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:pxwz1c/oyGqAtttttwgGTyWI+t5zEV2DGZUwWwld1dt7pryzSPFTsBNDLH1fV0ez:0CTE0dEcDG445UztTH1meeF4
TLSH F3453A1063F94615F2F62BB098BFDF701B727C92A835D29D2E8535DF2A71B409A60723
Reporter @abuse_ch
Tags:geo img SnakeKeylogger TUR


Twitter
@abuse_ch
Malspam distributing SnakeKeylogger:

HELO: mx.orc.lt
Sending IP: 88.119.96.96
From: HALKBANK.E-EKSTRE-halkbaHALKBANK.E-EKSTRE@halkbank.com.tr <indre.norkaitiene@orc.lt>
Reply-To: philiphulm@hotmail.com
Subject: T.HALK BANKASI A.Ş. 02.01.2021 - 23.02.2021 Hesap Ekstresi
Attachment: Halkbank_Ekstre_20210223_082357_541079.img (contains "Halkbank_Ekstre_20210223_082357_541079.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/4300b04da881e72e48c41cbcce73da7472580f3095bd0783ffb638c3b8e3a489
Detection:
n/a
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4300b04da881e72e48c41cbcce73da7472580f3095bd0783ffb638c3b8e3a489/
Threat name:
Win32.Spyware.Convagent
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 07:27:18 UTC
AV detection:
8 of 47 (17.02%)
Threat level
  2/5
Detection(s):
Suspicious file
Link:
https://www.spamhaus.org/query/hash/imalatniqhts4sgeds6m4462orzfqdzqsw6qpa77wy4mhohduseq._file
Threat name:
Malicious File
Score:
1.00

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 4300b04da881e72e48c41cbcce73da7472580f3095bd0783ffb638c3b8e3a489

(this sample)

SnakeKeylogger

Executable exe 00d3e7d88de8913e2682e8cb5feb6317e275fbacfc3668450ba511acd7744d90

  
Dropping
MD5 e420b36a4962c9bbf14ddb10109c68ad
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 00d3e7d88de8913e2682e8cb5feb6317e275fbacfc3668450ba511acd7744d90

Comments