MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 277198b8d7f23797cbbb2c65643df0ef07d259bdabb33afe54b77a4be09c0694. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 277198b8d7f23797cbbb2c65643df0ef07d259bdabb33afe54b77a4be09c0694
SHA3-384 hash: f75bc2ae7b74c0bdd0ee7600a8e6a6a1491375cbbd54fa99e6c733fb487b5581b86312e48143472abc169ad88d14d9d9
SHA1 hash: cabaeb4576880cef2e76840cb31b96aa14f955be
MD5 hash: e8c250f9df1e7efabc97e05da34993f0
humanhash: whiskey-magazine-victor-eighteen
File name:40900900090000.LZH
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:167'648 bytes
First seen:2021-06-10 05:43:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:6+q+a6L2GsUziBYHdKF5xP0/l506plc5yF58jRWPdiz+5AhEZbPOU+MPnA5w1GJo:6+ha6aVaiu98xc/piA5aRWFiz4AutPBn
TLSH 10F312DCA3AF6AC7C09DC4E5DADC6486689544BBA2C0D93BE74EBF0BED813D51640242
Reporter cocaman
Tags:lzh SnakeKeylogger zip


Avatar
cocaman
Malicious email (T1566.001)
From: "elifkardes@gmail.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.58.136]) "
Date: "9 Jun 2021 21:32:26 -0700"
Subject: "=?UTF-8?B?5paw5o6h6LO86KiC5Zau77yaNDgwMTA0NzM=?="
Attachment: "40900900090000.LZH"

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

SecuriteInfo.com..194.17770.UNOFFICIAL
Create hunting rule

PUA.Win.Trojan.Casino-141
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/277198b8d7f23797cbbb2c65643df0ef07d259bdabb33afe54b77a4be09c0694
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/277198b8d7f23797cbbb2c65643df0ef07d259bdabb33afe54b77a4be09c0694/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-06-10 05:44:10 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e5yzrogx6i3zps53frswippq54d5ewn5voztv7suw55exye4a2ka._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210610-4lj6nvwbte/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/277198b8d7f23797cbbb2c65643df0ef07d259bdabb33afe54b77a4be09c0694

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 277198b8d7f23797cbbb2c65643df0ef07d259bdabb33afe54b77a4be09c0694

(this sample)

SnakeKeylogger

Executable exe a36916873dbf1ca41d386367277ac89d8f4174939b81a15d7c6e5b7db5bd9909

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a36916873dbf1ca41d386367277ac89d8f4174939b81a15d7c6e5b7db5bd9909

Comments