MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16b48feccf564fe560c611fe56aa75bb668c62a71bfb2f8681489c1818b056e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16b48feccf564fe560c611fe56aa75bb668c62a71bfb2f8681489c1818b056e9
SHA3-384 hash: 328561db02aa11755f09946b183ca56f74c2b55ee096cac20663866b522f497a4b53ef2ea5c1ee91eb00f8fb3e898fc3
SHA1 hash: 5ebdbdda738f0dff172eb0f042eaeb60d66d8516
MD5 hash: fd48bbd5b180b4c8767e03ea9a16ed72
humanhash: west-lithium-iowa-harry
File name:34007#40FT.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:845'466 bytes
First seen:2021-03-17 06:40:07 UTC
Last seen:2021-03-17 08:32:53 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:BXtbh3mzYEydXCW4pxiCMIyQ4JCUY3S0B5i5gbRGK0+QdBub/niwrB30acl5Cuk7:B/XBcWt5QlUY3S0B5g7+x3ivGuk7
TLSH C20533CE00B53533ECB42B6A55D69FAFB040749A7A0DC82B7871C9E5944112F38BA7F6
Reporter cocaman
Tags:gz INVOICE SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "putri@id.asmaragroup.com" (likely spoofed)
Received: "from id.asmaragroup.com (unknown [64.52.174.242]) "
Date: "16 Mar 2021 20:18:28 -0700"
Subject: "Fw: invoice"
Attachment: "34007#40FT.gz"

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16b48feccf564fe560c611fe56aa75bb668c62a71bfb2f8681489c1818b056e9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 08:54:20 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c22i73gpkzh6kyggch7fnktvxntiyyvhdp5s7bubjcobqgfqk3uq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/16b48feccf564fe560c611fe56aa75bb668c62a71bfb2f8681489c1818b056e9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 16b48feccf564fe560c611fe56aa75bb668c62a71bfb2f8681489c1818b056e9

(this sample)

SnakeKeylogger

Executable exe 596333128235cdde25fdcf5d2346202f54fa0af9028549512d6317d95283f861

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 596333128235cdde25fdcf5d2346202f54fa0af9028549512d6317d95283f861
  
Dropping
SnakeKeylogger

Comments