MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c6ab55eeb9c6860e323d83db778de04484ecca9e44766078985e8ed9e5fd42e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c6ab55eeb9c6860e323d83db778de04484ecca9e44766078985e8ed9e5fd42e
SHA3-384 hash: 2158c0f11dc747d6b8dd94e8dd0a190c107d6074ffea2189a65334b5bb1de8545876b639b0e79a758676805fc5e0ff02
SHA1 hash: b4b87e37c9263888a6996b598eea5048f1a219b0
MD5 hash: 607128d07d71acd1bfbda6d8a6c4e5c7
humanhash: spring-december-october-delta
File name:Doc_Invoice_Pic_Inquiry.z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'537'216 bytes
First seen:2021-02-11 07:30:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:JJ1US6/LES649roxn2zkPDJJ+xSMwbPwHocDbRJo0dnIY0srDDCM:rfd2Ovv+lUUXhIkDD5
TLSH 3A6533A9FCFD6618B45C1F9A04E24F4ACB42765F71C773D2932CA8E80D94257340EA8B
Reporter abuse_ch
Tags:SnakeKeylogger Yahoo z


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: sonic307-8.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.64.32
From: Micheal Gauger <r_palari@yahoo.com>
Reply-To: onnybekee@protonmail.com
Subject: stock availability
Attachment: Doc_Invoice_Pic_Inquiry.z (contains "QUOTATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_ics.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23344.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c6ab55eeb9c6860e323d83db778de04484ecca9e44766078985e8ed9e5fd42e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-12 04:16:41 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=frvlkxxltrugbyzd3a63o6g6aree5tfj4rdwmb4jqxuo3hs72qxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c6ab55eeb9c6860e323d83db778de04484ecca9e44766078985e8ed9e5fd42e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 2c6ab55eeb9c6860e323d83db778de04484ecca9e44766078985e8ed9e5fd42e

(this sample)

SnakeKeylogger

Executable exe 96419e24a139be22003f18188eb9d4eac5fb5b8372dd055509365d0d6e4665d4

  
Dropping
MD5 46f606d353f874f3a7d331919337fa4e
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96419e24a139be22003f18188eb9d4eac5fb5b8372dd055509365d0d6e4665d4

Comments