MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04c5cdc7f69676fd990fb28edd97f3bd0200099bc7327c17927c93e466b72452. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04c5cdc7f69676fd990fb28edd97f3bd0200099bc7327c17927c93e466b72452
SHA3-384 hash: 8348b97c8ed32a71e14695d774d4a26a13c747d65b1b024e768141cf469a763b6f3b1e1a0d0393b0514e741df5b624e8
SHA1 hash: ae097c61ed52fcd0b712847f51048913b68d6017
MD5 hash: a9b616ad1ccb80165637f637e2222a44
humanhash: cardinal-pennsylvania-autumn-emma
File name:Purchase Order.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:569'069 bytes
First seen:2021-02-09 06:35:48 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:iDd/xYnVN/Qu0fXF3lauiZLxr5/JkdFMwLAnMmrPAgjkrq:YaoL1aJhkdFvL9mccKq
TLSH 1DC42387D163829028DB1EB03DD716A0EF38CDC1333B661E36028D7643A7E59956ADCB
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: tutanota.com.de
Sending IP: 46.183.220.42
From: Nicos Chang<imports@tutanota.com.de>
Subject: ref No.:10339/12-21/2021
Attachment: Purchase Order.gz (contains "Purchase Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27247.GZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04c5cdc7f69676fd990fb28edd97f3bd0200099bc7327c17927c93e466b72452/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 18:05:38 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=atc43r7wsz3p3gipwkhn3f7txubaacm3y4zhyf4spsj6izvxerja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04c5cdc7f69676fd990fb28edd97f3bd0200099bc7327c17927c93e466b72452

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 04c5cdc7f69676fd990fb28edd97f3bd0200099bc7327c17927c93e466b72452

(this sample)

SnakeKeylogger

Executable exe 551f62709e81c5aae58beb29ab56cc7fc139516ffa19b9366969d0fac1fad88b

  
Dropping
MD5 88efecec6d7e755fb8ad1c7d3576c60f
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 551f62709e81c5aae58beb29ab56cc7fc139516ffa19b9366969d0fac1fad88b

Comments