MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 160fec147bda4e4ea91364fb027b97025a91723120098f3f1c0217801b3871b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 160fec147bda4e4ea91364fb027b97025a91723120098f3f1c0217801b3871b6
SHA3-384 hash: 304f7ffa20756156dc417790b65ee4b35d332f73c81a98f44a3f4e78b42c6bfec99b849517eada9b2af71e2df5f61c78
SHA1 hash: f0e18d690c238d3e8ef7cc2301675ef75aa35488
MD5 hash: d5064b03c21bc66ec52f475d5682399d
humanhash: equal-sixteen-bakerloo-july
File name:00000000987772021.pdf.xz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:525'745 bytes
First seen:2021-01-19 12:02:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:F5ynWtB4/i4XlNoBuqG5ktdIeEEPk+46ddDp/BMfJTzdLfjRPqAyB/o9Tup4jxv+:F5IW06P3G5kDJfDp/BMPJQA9k4LKWH8
TLSH 1FB423182CC4328FD960C2B0FA8E9517816B5BEF5D14B56CBA7B0129E1A906DCA973F4
Reporter abuse_ch
Tags:SnakeKeylogger xz


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: maxguibani@gmail.com
Subject: INVOICE
Attachment: 00000000987772021.pdf.xz (contains "00000000987772021.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_justnumexe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/160fec147bda4e4ea91364fb027b97025a91723120098f3f1c0217801b3871b6/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 12:03:06 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cyh6yfd33jhe5kitmt5qe64xajnjc4rreaey6py4ailyagzyog3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/160fec147bda4e4ea91364fb027b97025a91723120098f3f1c0217801b3871b6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 160fec147bda4e4ea91364fb027b97025a91723120098f3f1c0217801b3871b6

(this sample)

SnakeKeylogger

Executable exe c3651ed2c59e56af93418b56a8fc12fd557d37f5905ac00fd8885f748af97c38

  
Dropping
MD5 c11c5375e304a5f8bf9cd85bf4c26758
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3651ed2c59e56af93418b56a8fc12fd557d37f5905ac00fd8885f748af97c38

Comments