MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 050888eed70e9e5085931f65a35af23d6e2eb9a63a5463f72c2267ded0ce9394. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 050888eed70e9e5085931f65a35af23d6e2eb9a63a5463f72c2267ded0ce9394
SHA3-384 hash: 80ac2b28b28e45e1b8e05c9b5dd637771408e6bbcbf3bfb851b85d6235fac4302a13db03930d77445e8db33067805ee4
SHA1 hash: 00c0c399166093a00f8ce92d3982bd01d0808855
MD5 hash: 0d351aef535a0f5b2ad824c6bef1ab6c
humanhash: london-harry-orange-pennsylvania
File name:Statement.pdf.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:314'098 bytes
First seen:2021-02-02 07:44:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:MasOqhr3DX8rEkdMmlm+cng1gWP1LmTz4Pc8DyjRFQMHRbmp6ZKaImmkWh62YViZ:Mcqhr3DM9dnlm+Cgi2Yr8DyjRtbvcaYZ
TLSH 2164224B283564E0857E35938AB80B6FA41FB4CCD990EFCA849B501E0B64B5FEE533D4
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: Information Noosa balustrading <info@noosabalustrading.com.au>
Subject: RE: Statement
Attachment: Statement.pdf.gz (contains "Statement.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/050888eed70e9e5085931f65a35af23d6e2eb9a63a5463f72c2267ded0ce9394/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 07:45:06 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
14 of 45 (31.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aueir3wxb2pfbbmtd5s2gwxshvxc5onghjkgh5zmejt55ugosoka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/050888eed70e9e5085931f65a35af23d6e2eb9a63a5463f72c2267ded0ce9394

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 050888eed70e9e5085931f65a35af23d6e2eb9a63a5463f72c2267ded0ce9394

(this sample)

SnakeKeylogger

Executable exe 0c3d1e60a1f6caa8bc2c84704ccf93ff2096891b6b5693952f5417c5aa577ee1

  
Dropping
MD5 33bf6b23969f03b1273498e2b35cc1a9
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0c3d1e60a1f6caa8bc2c84704ccf93ff2096891b6b5693952f5417c5aa577ee1

Comments