MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26758fd500d221f16a7e937918559aa9633448b34eaf206283d1e234e967a3a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26758fd500d221f16a7e937918559aa9633448b34eaf206283d1e234e967a3a8
SHA3-384 hash: 6f883c5ac7a79dca07dc8b18aad6d20397982632c9441c85a3694202993c96e39e61f4f5d718242267459428c4461816
SHA1 hash: e267bbb7e3a2c6e5be4558d99925f382746a8766
MD5 hash: c4ce28b7a092d4e6d06527a6dd11289a
humanhash: asparagus-magnesium-avocado-alabama
File name:RFQ - 0201201.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:831'394 bytes
First seen:2021-02-02 07:46:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:AzcQlyB3AKV4N0ki0dAe2a+Lzbo8fti8s+7QBYXdBg/pEk7:TYyB3oNnnae2a+Dy1KQBVJ7
TLSH D2052354569D8F758B1A3B0E395E22653D3CF048C428C361AAA4DFB49E6F9172BB0CD3
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.hondamultan.com.pk
Sending IP: 85.187.156.253
From: Roberto Carlos <Gururaj.Pai@depa.com>
Subject: Urgent: Request for Proforma Invoice....
Attachment: RFQ - 0201201.zip (contains "RFQ - 0201201.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26758fd500d221f16a7e937918559aa9633448b34eaf206283d1e234e967a3a8/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 07:47:11 UTC
AV detection:
10 of 45 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ez2y7via2iq7c2t6sn4rqvm2vfrtisftj2xsayud2hrdj2lhuoua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/26758fd500d221f16a7e937918559aa9633448b34eaf206283d1e234e967a3a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 26758fd500d221f16a7e937918559aa9633448b34eaf206283d1e234e967a3a8

(this sample)

SnakeKeylogger

Executable exe 0a1bb1a2004b1405b80cfcb2249c2cfab85aaed1cad4eb95da780f0f87cd22a3

  
Dropping
MD5 ac9e24a80fc509b8e49c204b46c723d2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a1bb1a2004b1405b80cfcb2249c2cfab85aaed1cad4eb95da780f0f87cd22a3

Comments