MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24e10266a97f7e6ded7e0701f00fc7e70196de2cd7b6e201b1eec4acbc03ba14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24e10266a97f7e6ded7e0701f00fc7e70196de2cd7b6e201b1eec4acbc03ba14
SHA3-384 hash: 9cb83b9e1f3535c3705a13fa5f94d42a77b42de969900ca932e305b4652d7c32d888562a95da5154d4fe24b5578de931
SHA1 hash: 1a3d57d7864259455db9d09795435743688c3307
MD5 hash: 7dd8c809e5bf67bd47bfba2589059860
humanhash: indigo-florida-uniform-chicken
File name:PURCHASE ORDER - XIFFA55.PDF.iso
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:935'936 bytes
First seen:2021-04-07 06:01:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:6PbHRJ3DnxQ8lzdWDqSsvwSL1PW9i9mZhPRlrSMgFk/qV:KjznK8RoDqmSLpW9Om/Rq
TLSH 7A15D02232946F65E5BEA7769060416083F2FD47E736D68D3C9CB0DD2B72AC1C262793
Reporter abuse_ch
Tags:iso SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: vmmail02.ridsa.com.ar
Sending IP: 190.103.224.9
From: Lester Alvarez <keith.phillips@ecoglo.com>
Subject: PURCHASE ORDER - XIFFA55
Attachment: PURCHASE ORDER - XIFFA55.PDF.iso (contains "PURCHASE ORDER - XIFFA55.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1146.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24e10266a97f7e6ded7e0701f00fc7e70196de2cd7b6e201b1eec4acbc03ba14/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 04:40:15 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=etqqezvjp57g33l6a4a7ad6h44aznxrm263oeanr53ckzpadxika._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/24e10266a97f7e6ded7e0701f00fc7e70196de2cd7b6e201b1eec4acbc03ba14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso 24e10266a97f7e6ded7e0701f00fc7e70196de2cd7b6e201b1eec4acbc03ba14

(this sample)

SnakeKeylogger

Executable exe 23c566938824db35e8806a9f51f245cfd91e379016d76ba7a5cba8bca5e4b251

  
Dropping
MD5 3e50a619af93a8d78fd957464fcc299e
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 23c566938824db35e8806a9f51f245cfd91e379016d76ba7a5cba8bca5e4b251

Comments