MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2682fc29e8e6589514add3da9836f2d88c3cc22f1df28c8cd6c708927fae2775. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2682fc29e8e6589514add3da9836f2d88c3cc22f1df28c8cd6c708927fae2775
SHA3-384 hash: 6aaefe4073a26ee3bdbb58bdeaa8b4351aa9acbe7810427bce9dbc7f6f3c7763b3c4a6084c7df5cac20201c7924ae5f0
SHA1 hash: e8a1b8b995aabf410b12236dc892cc9f72e562fb
MD5 hash: dfa2387fee31c8b15f1bd8113ca0ccda
humanhash: potato-don-potato-arizona
File name:DHL_DELIVERY_ITEMS_PDF.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:346'341 bytes
First seen:2021-02-16 06:38:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:+8TkV1nS47IhIot8xq983Xk4Lgtb3BJVWPcolJmXLKGs0TGn0SEq:VX4CIDQR0Cz9G0W
TLSH B97423EA3F45F9C1846885D6E218D1C0297DFF027CD4F540E462A87B1825BB32A9E7ED
Reporter abuse_ch
Tags:DHL rar SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: server2.visualweb.es
Sending IP: 213.192.239.103
From: DHL EXPRESS (ES) <buhimport@dhl.com>
Reply-To: result.box2019@mail.com
Subject: DB_DHL_AWB_00117390021 / AD
Attachment: DHL_DELIVERY_ITEMS_PDF.rar (contains "DHL_DELIVERY_ITEMS_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2682fc29e8e6589514add3da9836f2d88c3cc22f1df28c8cd6c708927fae2775/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-16 06:39:13 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e2bpykpi4zmjkffn2pnjqnxs3cgdzqrpdxzizdgwy4eje75oe52q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/2682fc29e8e6589514add3da9836f2d88c3cc22f1df28c8cd6c708927fae2775

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 2682fc29e8e6589514add3da9836f2d88c3cc22f1df28c8cd6c708927fae2775

(this sample)

SnakeKeylogger

Executable exe 0820ffc8c51cbdef8773f5455348cb85bf9fd42c2f872bc0909734accbf27c13

  
Dropping
MD5 6b68f809c33757297eb100661217fe7b
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0820ffc8c51cbdef8773f5455348cb85bf9fd42c2f872bc0909734accbf27c13

Comments