MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e63abdebeb5dd1e8db6390e1ffda54690d6e7897fbfa9b8fb2a9943fc1e057f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e63abdebeb5dd1e8db6390e1ffda54690d6e7897fbfa9b8fb2a9943fc1e057f
SHA3-384 hash: 9f183917c5f286cbda6fcd015eacfca5a0e49c95d6857ead9f86e6e2b206608667d1f0d50b5f6aba75fdab728bb72ac0
SHA1 hash: 669278b027c0561a2ef25461f4e32e6c3ab213b3
MD5 hash: 4fbe5a6c0f67cf0d97af2b7ae3b8ea67
humanhash: virginia-august-wolfram-moon
File name:DHL Express04017.img
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:2'097'152 bytes
First seen:2021-01-21 17:24:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:i2z6350jwcEc6tvuI0a646v6oAXx9R6WsVn3Rg7FldVZFHZhc:ihp08cEc6tvz7646v64m7FlbZF7
TLSH 5FA5AE0A91064593E9543C36846F2F944744ABBE3892D3D7B80D3723FB91FCC6A869F9
Reporter abuse_ch
Tags:DHL img SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dhl.com
Sending IP: 104.168.218.213
From: DHL Express<DHLservice@dhl.com>
Subject: DHL Shipping Document/Invoice Receipt
Attachment: DHL Express04017.img (contains "IMG_04017.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e63abdebeb5dd1e8db6390e1ffda54690d6e7897fbfa9b8fb2a9943fc1e057f/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-01-21 17:25:08 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fzr2xxv6wxor5dnwhehb77nfi2innz4jp672toh3fkmuh7a6av7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e63abdebeb5dd1e8db6390e1ffda54690d6e7897fbfa9b8fb2a9943fc1e057f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 2e63abdebeb5dd1e8db6390e1ffda54690d6e7897fbfa9b8fb2a9943fc1e057f

(this sample)

SnakeKeylogger

Executable exe f9a8ba23f68d57179f1a480b6207351d5f41e6303fbdd09f6fffd514f82bef30

  
Dropping
MD5 9b2bde9769d02bac7e022ff7a36010e5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f9a8ba23f68d57179f1a480b6207351d5f41e6303fbdd09f6fffd514f82bef30

Comments