MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08e52949642373987bd07a23f7b7b37628de0a1fbc59ec04a340205ad4402e2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08e52949642373987bd07a23f7b7b37628de0a1fbc59ec04a340205ad4402e2d
SHA3-384 hash: c8ab468c43ec6ee9764b0760168128f261fc10c4ae311e60a51ee6ce9810f79b2a58471d8c7e67f6d73441b645be802b
SHA1 hash: 4d2065698f893d29b51c53213c758152bc53e320
MD5 hash: d25cf400939436e91d55b059e5ae7aeb
humanhash: carolina-lemon-video-autumn
File name:PO on demand 4000270283-B60.7z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:534'438 bytes
First seen:2021-02-17 13:32:56 UTC
Last seen:2021-02-17 20:23:38 UTC
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:V5ApWBxH+qVGxY5uCgLiIaZOWt4P5E+tWZcPI:Vi4H+qHuCocBt4P5rg
TLSH B5B423CBC6F628A5A43A32B9350C1FCDB7F3E1CD59DA8B1BB09ADEAF554C2540627140
Reporter abuse_ch
Tags:7z SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: partsmachine.com
Sending IP: 45.88.3.88
From: Holdener Alex <alex.holdener@partsmachine.com>
Subject: PO on demand 4000270283-B60
Attachment: PO on demand 4000270283-B60.7z (contains "PO on demand 4000270283-B60.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Sanesecurity.Malware.25544.7zHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08e52949642373987bd07a23f7b7b37628de0a1fbc59ec04a340205ad4402e2d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 12:18:21 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdssssleenzzq66qpir7pn5toyun4cq7xrm6ybfdiaqfvvcafywq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08e52949642373987bd07a23f7b7b37628de0a1fbc59ec04a340205ad4402e2d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

7z 08e52949642373987bd07a23f7b7b37628de0a1fbc59ec04a340205ad4402e2d

(this sample)

SnakeKeylogger

Executable exe 14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65

  
Dropping
MD5 3fe2596f06b31058fb5614b5d9f7bc0f
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65

Comments