MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fa5003ed6c2bdfbdb16d87a37141668e5b272e04984c3e348f4161d14c03d92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fa5003ed6c2bdfbdb16d87a37141668e5b272e04984c3e348f4161d14c03d92
SHA3-384 hash: 3215221b5ea07ef77290ea7b7ad9d412a279874486da3c250da6da57cf0d4ef9cbe88dc548d26a28a3ab0fe805169a6b
SHA1 hash: 764f014470e52808700332d48af873421ab5d975
MD5 hash: 3e66c25a1ad7fe1d5b4a7e67324ba8e6
humanhash: undress-delta-cola-social
File name:orden de compra_pdf___________________________________.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:591'838 bytes
First seen:2021-01-15 13:52:45 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:EAFO4BtoK4Q24T/a/noApu70t5DCSWbdPwWm6ihKx5wGl5FIKIk11ZY:Xk4BtoK9T/EfJt5GSWaJsHJl7tIKrY
TLSH BDC423457648552DA4BA3628E8A6C7F7E9C86C8DB4F7532890C41E913E020FCD52FFCA
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: key-code.fr
Sending IP: 185.222.57.81
From: Pablo<info@key-code.fr>
Subject: orden de compra
Attachment: orden de compra_pdf___________________________________.gz (contains "orden de compra_pdf___________________________________.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fa5003ed6c2bdfbdb16d87a37141668e5b272e04984c3e348f4161d14c03d92/
Threat name:
Win32.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 13:53:05 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6sqapwwyk67xwyw3b5dofawnds3e4xajgcmhy2i6qlb2fgahwja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2fa5003ed6c2bdfbdb16d87a37141668e5b272e04984c3e348f4161d14c03d92

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 2fa5003ed6c2bdfbdb16d87a37141668e5b272e04984c3e348f4161d14c03d92

(this sample)

SnakeKeylogger

Executable exe 716aacac1a8cdbf59b820beee36b621674f1f1d01f0ca7c7ca5c9d419d764f09

  
Dropping
MD5 dfb1ff12546e0d135294387f0d02e977
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 716aacac1a8cdbf59b820beee36b621674f1f1d01f0ca7c7ca5c9d419d764f09

Comments