MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ef66476dfed0997ef72acffb86091b0fe3fddcd9e4696b74472293f62af676e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ef66476dfed0997ef72acffb86091b0fe3fddcd9e4696b74472293f62af676e
SHA3-384 hash: 6de987e479e2fc709b5f98d5b5f40ba6304cfcf5710bf7ad41d65cb9ea552a9e13d878f10043027cb1e625208742acfd
SHA1 hash: 6a4f54c0d2ae0dbc8b943772cafc1554c58260d8
MD5 hash: 66d9d2008a8eb5b787456609ef28a98b
humanhash: iowa-earth-cola-two
File name:PURCHASE_ORDER_N_83194.IMG.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:297'366 bytes
First seen:2021-02-02 15:51:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:C00nnvIf8fT5Rd/qKoLcA5iIZGGgq2lgblqIhbX3zAjj44:D0nnvIO/qKoYIZ4qJxLj3EjjF
TLSH 355423066F9C754C9D1CD1BCBC7A1506AE9CA0F3B7E80B07B7E652893225F089CE604D
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rslog.com.cn
Sending IP: 103.99.1.142
From: resleypeng.sh@rslog.com.cn
Subject: Fwd: Purchase Order n° 831947 / DLB026
Attachment: PURCHASE_ORDER_N_83194.IMG.rar (contains "PURCHASE_ORDER_N_83194.IMG.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.MSIL.Kryptik.ZMW.99545.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ef66476dfed0997ef72acffb86091b0fe3fddcd9e4696b74472293f62af676e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 12:50:45 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f33gi5w75uezp33svt73qyerwd7d7xontzdjnn2eoiut6yvpm5xa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ef66476dfed0997ef72acffb86091b0fe3fddcd9e4696b74472293f62af676e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 2ef66476dfed0997ef72acffb86091b0fe3fddcd9e4696b74472293f62af676e

(this sample)

SnakeKeylogger

Executable exe 972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef

  
Dropping
MD5 c569946f2ea5bd451796c0d9deb5c231
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 972ae3565c25bfb5ffc5cb68ca7f1e2296446a8c73cf60499c8fbe9e5f1d55ef

Comments