MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 161aa34f1cbe568e1c6bfa1f8c43b9514a223a8d681a0215f339f061be4c0b42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 161aa34f1cbe568e1c6bfa1f8c43b9514a223a8d681a0215f339f061be4c0b42
SHA3-384 hash: 7837887bbb2de65ae4b2b7684ae2d6ae34a99ef1fc3a3d5c7401f06fcd748c724d403dda6271b05e28fcf6e5b2bf70fe
SHA1 hash: 00e9935882ee15a47d6d4c539dcb1d94bd3c6270
MD5 hash: 4dbf0f30a7170a1fec11212791e6df7e
humanhash: nevada-quebec-robert-timing
File name:DHL EXPRESS.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:496'427 bytes
First seen:2020-12-22 07:05:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:8qlLYf28rWAA6zAMCdyNGKMljQu+X3VxmZKpLUCShkp9ljUps2:8wLsL3A6zJNNUj5+X3bmZeLU7he9lGX
TLSH 2DB423A35F57CD7AEF425477243EAA12D2C6DAA6C737C230E82430AF22970D5E5DB484
Reporter abuse_ch
Tags:DHL zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.a1terainfra.com
Sending IP: 45.85.90.118
From: DHL EXPRESS <office@a1terainfra.com>
Subject: FWD:DHL EXPRESS
Attachment: DHL EXPRESS.zip (contains "DHL EXPRESS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
288
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25714.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/161aa34f1cbe568e1c6bfa1f8c43b9514a223a8d681a0215f339f061be4c0b42/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 07:06:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cynkgty4xzli4hdl7ipyyq5zkffceounnanaefpthhygdpsmbnba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.78
Link:
https://yomi.yoroi.company/submissions/161aa34f1cbe568e1c6bfa1f8c43b9514a223a8d681a0215f339f061be4c0b42

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 161aa34f1cbe568e1c6bfa1f8c43b9514a223a8d681a0215f339f061be4c0b42

(this sample)

SnakeKeylogger

Executable exe 50b4aec831a717654b19c4130dd0187354d47a932e8f7b1878f931132223a1ef

  
Dropping
MD5 cf31402edf98c720b4f0e282fe569f8a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50b4aec831a717654b19c4130dd0187354d47a932e8f7b1878f931132223a1ef

Comments