MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a3a6f71ab223a83c160319b03eed2b2a2f499381fb0d8d4c78b1955c9ac5563. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a3a6f71ab223a83c160319b03eed2b2a2f499381fb0d8d4c78b1955c9ac5563
SHA3-384 hash: 20d319ff44c4d20b8bda8df1e1b7bad62e88c918aa385fb86ebbd09aae5cf9b918b634f5c03c1fbc8f7d8542ac632372
SHA1 hash: 29a0da72aec1ffed29d2a1b1ba7a1ccaca6f48a0
MD5 hash: e26d847da7fb94790bda40653258a57c
humanhash: emma-massachusetts-glucose-georgia
File name:IMG_Catalogue Document.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'108'837 bytes
First seen:2021-02-16 14:20:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:qRpai+zCiBH5zhlR26UWMyxG/w4c1vbLgQPe8:Ot+uIH5DnUWXxG/wlTMn8
TLSH 9335337F7420DA37D9A32591C7A87E0104049B6D39DB8971C13F2C6AADAEDB150B1D3B
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cva6.toservers.com
Sending IP: 181.119.48.183
From: Sales Manager <sales6@ritiagroup.com>
Subject: pipes and fittings/Carbon steel
Attachment: IMG_Catalogue Document.zip (contains "IMG_Catalogue Document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1702.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25676.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22989.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a3a6f71ab223a83c160319b03eed2b2a2f499381fb0d8d4c78b1955c9ac5563/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-16 14:20:11 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fi5g64nlei5ihqlaggnqh3wswkrpjgjyd6ynrvghrmmvlsnmkvrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a3a6f71ab223a83c160319b03eed2b2a2f499381fb0d8d4c78b1955c9ac5563

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 2a3a6f71ab223a83c160319b03eed2b2a2f499381fb0d8d4c78b1955c9ac5563

(this sample)

SnakeKeylogger

Executable exe b6ce907a6f4755fdb15dcf94fe846ee1214806b69e8288e2b480aab57d4333b1

  
Dropping
MD5 d7dd6b7b5ec7a51fdf361c054ab58cad
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b6ce907a6f4755fdb15dcf94fe846ee1214806b69e8288e2b480aab57d4333b1

Comments