MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24eb684917cbd44e8eb9135b969408ff60e76b85e277a8ee4f83b5dabcc11cc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24eb684917cbd44e8eb9135b969408ff60e76b85e277a8ee4f83b5dabcc11cc5
SHA3-384 hash: b80366a61ea1218962a512234c6579ea523b6227733e2bafc8ee7f1118b68fb936e02ed59adae312f5e3a68dbe7ea06a
SHA1 hash: 17426accf7408ec4b368cd1ee8e5c89df4396af3
MD5 hash: 210bcd3c3626b3e50b6320b675841dcf
humanhash: oscar-mike-robert-april
File name:Copy_Payment.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:357'020 bytes
First seen:2021-01-18 08:11:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:TS+sZioRuet9wevgzaaAEyLXMBIQsBuNoBGp/3LKf4PtP5kqtuE/8hGUyf:8ZiUDozaaAEyDMBnxN3LK4PVPX/ATm
TLSH 1E7423089963D7FF60316B31C9426AFBD9B864FB5F28432C16422DE9A63B917C4D3097
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ENSDMAIL01.vredestein.com
Sending IP: 217.119.236.204
From: Jannick Ditlevsen <Jannick.Ditlevsen@apollovredestein.com>
Subject: Balance - Invoice of 50% payment
Attachment: Copy_Payment.rar (contains "Copy_Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24eb684917cbd44e8eb9135b969408ff60e76b85e277a8ee4f83b5dabcc11cc5/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:12:16 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=etvwqsixzpke5dvzcnnznfai75qoo24f4j32r3spqo25vpgbdtcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/24eb684917cbd44e8eb9135b969408ff60e76b85e277a8ee4f83b5dabcc11cc5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 24eb684917cbd44e8eb9135b969408ff60e76b85e277a8ee4f83b5dabcc11cc5

(this sample)

SnakeKeylogger

Executable exe 1230eb0bae862921bb0a575c1bfb9055984d24359f0c49282ef49eadad6091ce

  
Dropping
MD5 f111a6c177f89658cf8e651d3bc2e399
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1230eb0bae862921bb0a575c1bfb9055984d24359f0c49282ef49eadad6091ce

Comments