MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b7066088aee97190289f85f91b65ddfa585345c2405da68332f2da90269410d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b7066088aee97190289f85f91b65ddfa585345c2405da68332f2da90269410d
SHA3-384 hash: 5309414fe290815b0d9a335a07852e58e179797dde4aa6b2e0f9e5f4508fdd6de814fdf358d7ee188c3ec5994fca818d
SHA1 hash: 6bfdd6c0a4a55f365e7208ce1972d5a56cc8bbb6
MD5 hash: 0dcdeef46b6a2872fef4ac253ebc8769
humanhash: violet-michigan-tennessee-salami
File name:IMG_71103.pdf.iso
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:2'097'152 bytes
First seen:2021-01-18 07:54:05 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:DyzF/B1YEF+jrwQdB+Vdu/0Rzs+fLYo/Hp4sawrK6VAc:WzJB1YEFO9dwz9j/2KS
TLSH 38A58D06D11E4143D9203CB9881F2F9C4744DAAEE982D3D6BB0E772FF691FC85A815E9
Reporter abuse_ch
Tags:iso SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: subi.iwebi.in
Sending IP: 148.251.54.43
From: Cyrus Dmitriy <nexa@nexa.co.kr>
Subject: stock statement for the month of january-2021
Attachment: IMG_71103.pdf.iso (contains "IMG_71103.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b7066088aee97190289f85f91b65ddfa585345c2405da68332f2da90269410d/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 06:33:39 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dnygmcek52lrsauj7bpzdns536syknc4eqc5u2btf4w2satjiegq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1b7066088aee97190289f85f91b65ddfa585345c2405da68332f2da90269410d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso 1b7066088aee97190289f85f91b65ddfa585345c2405da68332f2da90269410d

(this sample)

SnakeKeylogger

Executable exe bd0d59702d2d99ee59e5d10834c234e2fa98bfb4d02b19500f3a67bbff70e7d5

  
Dropping
MD5 96677fa4409a98a04a9c87737eb1f167
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd0d59702d2d99ee59e5d10834c234e2fa98bfb4d02b19500f3a67bbff70e7d5

Comments