MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 317116ed0df67dceeff8552f2e7e43c023c252098164b5d8e3af79e3dbe0b0f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 317116ed0df67dceeff8552f2e7e43c023c252098164b5d8e3af79e3dbe0b0f0
SHA3-384 hash: 10d5ff11bdb0a4fb067547839554b1e63443f499c0ef56435e068a416d0171b88a2d55172a40df6f52b5405e7f3adcef
SHA1 hash: b8410644bc0536edd7abbae1d4079fb9abe878a7
MD5 hash: bd7a3656b420d3407261adc21ba7fc73
humanhash: whiskey-sad-delta-pasta
File name:AWA PO902909300004004003004034443333392-Requst for quotation.PDF .zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:756'915 bytes
First seen:2021-03-09 11:52:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ax6Dgx7TeErVEAB3HQD3Q2xke/eBsULvTFgGZBhMdqtIlsCEEM919zADz:a0s7TeTJDAaIdHRMUtJCE7iDz
TLSH ADF433D836497C672BF3A56A707E6B01CE757140FF522E8CF92D0BFAE0AE3445811868
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: box.aszus.com
Sending IP: 185.170.213.228
From: mossab <mossab@awa-foodadd.net>
Subject: RFQ AWA PHARMACEUTICAL PO9029093000392-Requst for quotation
Attachment: AWA PO902909300004004003004034443333392-Requst for quotation.PDF .zip (contains "AWA PO902909300004004003004034443333392-Requst for quotation.PDF .exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_Hideexe.4.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 02:54:28 UTC
AV detection:
24 of 47 (51.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gfyrn3in6z64537ykuxs47sdyar4euqjqfsllwhdv546hw7awdya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/317116ed0df67dceeff8552f2e7e43c023c252098164b5d8e3af79e3dbe0b0f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 317116ed0df67dceeff8552f2e7e43c023c252098164b5d8e3af79e3dbe0b0f0

(this sample)

SnakeKeylogger

Executable exe 1b2c524bb0fa98da137dea1c52082fb9271608892bf00bd1f8abb71492af2671

  
Dropping
MD5 57b82a99e03373b6b9e2380d1600ac5d
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b2c524bb0fa98da137dea1c52082fb9271608892bf00bd1f8abb71492af2671

Comments