MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e7f372c51c2da2aca429842e38e8fdf72f598f0ff812e3c51bfd958198ec36d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e7f372c51c2da2aca429842e38e8fdf72f598f0ff812e3c51bfd958198ec36d
SHA3-384 hash: 9b680b714e0ba4d6db1b81f0173ce772a100e02e9830c31f196618e59e17f67e83fe45d820524e8986b608e77875a6cd
SHA1 hash: e90beb2e280cf014dd66a16e254690aa9f425ada
MD5 hash: 56a2d01a314b8e27b2f081e0df10e36c
humanhash: arkansas-kansas-march-green
File name:00000000000900SA.z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:280'702 bytes
First seen:2021-01-12 06:20:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:i9eInK/dY5VWjibGuLAVCp9Qfoq2tpgK/FVTCV8dkcKI5/DXoAi1zcvVq7c:EK/sVWmGuLAVCb62tp9/XTJdcI5/D4At
TLSH 0F542264CBF6B501D8B81A378F483406BAA528E8778DEBF7B95483D523780D67E4B530
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: r.abouldahab@emis-int.com
Subject: Re: URGENT REQUIREMENT
Attachment: 00000000000900SA.z (contains "00000000000900SA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.16237.8900.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e7f372c51c2da2aca429842e38e8fdf72f598f0ff812e3c51bfd958198ec36d/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-12 06:20:08 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bz7tolcrylncvssctbbohdup35zplghq76as4pcrx7mvqgmoynwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e7f372c51c2da2aca429842e38e8fdf72f598f0ff812e3c51bfd958198ec36d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 0e7f372c51c2da2aca429842e38e8fdf72f598f0ff812e3c51bfd958198ec36d

(this sample)

SnakeKeylogger

Executable exe 7892a206704754cf7a094b04b2ad2e28cb7cfd310ad297f0f00a41bc561ebf03

  
Dropping
MD5 f9f1b66a0e3694995e4c4b6cae771929
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7892a206704754cf7a094b04b2ad2e28cb7cfd310ad297f0f00a41bc561ebf03

Comments