MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



SnakeKeylogger


Vendor detections: 5


Intelligence 5 File information Yara Comments

SHA256 hash: 54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87
SHA3-384 hash: 52b4b84da9fa2bf8760a5e038d704628d1d4d112f50eb32ea6936fc0525f77c6bfedc855f2ef7b8d06c361e4f9a9664b
SHA1 hash: 958d2fe87b76e8b81b6b9983b7ad92cd78ad4be3
MD5 hash: 02969d006c3f0735e1af5ec228e41506
humanhash: alpha-october-alabama-burger
File name:appprovedWJO-TT180,pdf.iso
Download: download sample
Signature SnakeKeylogger
File size:892'928 bytes
First seen:2021-02-23 06:57:46 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:hzPTExm6YzF0k8Ljz3WZcuZ+JLbvs2zlyAKp:h+gR0k8L/WiouzzlWp
TLSH AD155B1062F88245F1FA2BB09CBFDE702B723C89A879D25D2AC536DF2A717408565737
Reporter @abuse_ch
Tags:iso SnakeKeylogger


Twitter
@abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cloudhost-2248786.us-midwest-1.nxcli.net
Sending IP: 8.36.41.62
From: Nguyen Thi Loan <loannt1@imecovn.com.vn>
Subject: 新订单_WJO-TT180
Attachment: appprovedWJO-TT180,pdf.iso (contains "(appproved)WJO-TT180,pdf.exe")

Intelligence


File Origin
# of uploads :
1
# of downloads :
36
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Status:
Malicious
First seen:
2021-02-23 01:50:41 UTC
AV detection:
9 of 47 (19.15%)
Threat level
  5/5
Threat name:
Legit
Score:
0.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso 54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87

(this sample)

  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment

Comments