MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b58ae4b731aadaaccea9d3802afc6300f6c408050984be4807bddc33fb070f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b58ae4b731aadaaccea9d3802afc6300f6c408050984be4807bddc33fb070f6
SHA3-384 hash: 621268762d64dd565e01e28e412d7115f9ba86070f905b80f7b3a1861a5de62d0a17bf3ed8b4edf440fcb4052022fc39
SHA1 hash: dbea373892c995921332079e3b09467ad19c08ac
MD5 hash: 1eb69edd27ad919cc6815342e27243c2
humanhash: six-table-shade-vermont
File name:purchase order.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:413'531 bytes
First seen:2021-02-23 16:04:26 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:pB8zyiB548NLCFB/JbkzpEGuep/o4JYBlb6q0Ktfykfi5i7uuqypz3DrUI81xN3o:pazyw48mIp1RC4JYBgADSSwI8J3awrCN
TLSH 0D9423F9AD934BFA146FBA8A28908D0CBE131B679CD02C26F54E714191E1F74478D68F
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: vps.tecp0s.com
Sending IP: 203.159.80.121
From: office1@tecp0s.com
Subject: PO.
Attachment: purchase order.gz (contains "purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b58ae4b731aadaaccea9d3802afc6300f6c408050984be4807bddc33fb070f6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 16:05:09 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dnmk4s3tdkw2vthktu4afl6ggahwyqeakcmexzeappo4gp5qod3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/1b58ae4b731aadaaccea9d3802afc6300f6c408050984be4807bddc33fb070f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 1b58ae4b731aadaaccea9d3802afc6300f6c408050984be4807bddc33fb070f6

(this sample)

SnakeKeylogger

Executable exe 2530293893011f0133801e2f4365745ef9c25fca4bd11a9784bf1f46dd43a8f1

  
Dropping
MD5 20a188b16e6124789c1a315ce77968c6
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2530293893011f0133801e2f4365745ef9c25fca4bd11a9784bf1f46dd43a8f1

Comments