MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05112c2b0f3184ba0dd124cc26904d161ec3be795cda16ce2bb95f8a340a5b98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05112c2b0f3184ba0dd124cc26904d161ec3be795cda16ce2bb95f8a340a5b98
SHA3-384 hash: adc422d3bb687feddb1cf564d67de28064d820eea9e0f265e9fb931fb1196d22491be9b8ecd8c809e82a6b098a0f5f97
SHA1 hash: 555f1146367b97fc93c4a1bb43460626dbd0ef3b
MD5 hash: d41a90441184b7491facfe43a01d2540
humanhash: beer-tango-fillet-robert
File name:purchase order.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:9'509 bytes
First seen:2021-03-04 10:14:15 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 192:rR0nVfaKgMHcSqFplMSrRV04ubXaVoutZLLPQGOWUjBX/juZOTYU3Xmagte0v:l0nRaSqzlzxutuog85dkimagdv
TLSH C612AF5932FD2EE546B15128B37EB028CDA8EC755DE54F8525015062A4C3273BB8AFE2
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cl-t002-054cl.privatedns.com
Sending IP: 64.15.155.21
From: smtp-h3asi@australiastartups.org
Subject: PURCHASE ORDER
Attachment: purchase order.gz (contains "purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05112c2b0f3184ba0dd124cc26904d161ec3be795cda16ce2bb95f8a340a5b98/
Threat name:
ByteCode-MSIL.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 10:15:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=auisykypggcludoretgcnecncypmhptzltnbntrlxfpyunakloma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/05112c2b0f3184ba0dd124cc26904d161ec3be795cda16ce2bb95f8a340a5b98

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 05112c2b0f3184ba0dd124cc26904d161ec3be795cda16ce2bb95f8a340a5b98

(this sample)

SnakeKeylogger

Executable exe 496582d7d67b1550e8125986a011340fea205f882c7dfafd8384798eb2089480

  
Dropping
MD5 0a20b314bd3a87a0de510e3823710813
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 496582d7d67b1550e8125986a011340fea205f882c7dfafd8384798eb2089480

Comments