MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cc1604a149d9359d4674e672c82f2724da013bd029d62a100165ea8ba9cd7dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cc1604a149d9359d4674e672c82f2724da013bd029d62a100165ea8ba9cd7dc
SHA3-384 hash: 569b01dc37c997cba3f6d9852cfda786098cafc5c144ed985f80f88e4847c090f41364769d497aea2fccde30baa9f3c3
SHA1 hash: 9993f304102a6df97ce14dea702968bf77a5b0e2
MD5 hash: a3fa97cac9d497cc105fdc8720566070
humanhash: mars-purple-carbon-sodium
File name:INQUIRY-DRAWING.IMG
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'245'184 bytes
First seen:2022-04-22 06:33:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:ICdbzmcpnjtV43OMdnB1C9XSi0iYxne1:hb3dRV4+MRBgno
TLSH T19F45126616A84B36D9EF1BFA957122091734B2866213F3483DDC31EF1F127C49A11BBB
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:img SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Aya Ochi (Ms.)Technical & Supply Sec./ Marine Dept <info@vps-1059244-x.cmocarrion.com>" (likely spoofed)
Received: "from hwsrv-963325.hostwindsdns.com (hwsrv-963325.hostwindsdns.com [104.168.219.40]) "
Date: "21 Apr 2022 21:31:11 +0200"
Subject: "Additional Inquiry: MVEVER GOLDEN"
Attachment: "INQUIRY-DRAWING.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1731.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed pos replace.exe update.exe
Link:
https://www.filescan.io/uploads/62624c72482f2f41cae5f742/reports/a88da9c0-d605-40b6-bba8-fdd4677bcb5f/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2cc1604a149d9359d4674e672c82f2724da013bd029d62a100165ea8ba9cd7dc/
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2022-04-21 10:46:32 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
18 of 41 (43.90%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ftawasqutwjvtvdhjztszaxsojg2ae55akowfiiaczpkrou427oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2cc1604a149d9359d4674e672c82f2724da013bd029d62a100165ea8ba9cd7dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 2cc1604a149d9359d4674e672c82f2724da013bd029d62a100165ea8ba9cd7dc

(this sample)

SnakeKeylogger

Executable exe 85468a8943c49230eae5bf7a3194f4698d4df48891bd501dbb28eb53b737ac7d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85468a8943c49230eae5bf7a3194f4698d4df48891bd501dbb28eb53b737ac7d
  
Dropping
SnakeKeylogger

Comments