MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 317fec4108f6d85caa5c1589b983a87dc665140390975d2f96e54a8ab1ab2d34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 317fec4108f6d85caa5c1589b983a87dc665140390975d2f96e54a8ab1ab2d34
SHA3-384 hash: 8754e948e6014e8d073173cbefa8e0f27c417c28119d0d72db0c1a7eeb7894c2b01a32f8d1546e9b71f803528bc6f7b6
SHA1 hash: f4fc7ef9f53faf32cafb002f34ede7078175e6e9
MD5 hash: 56c9727d6d4e0af73218e73f62677000
humanhash: network-maryland-september-pizza
File name:000000090000-0990.xz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'203'232 bytes
First seen:2021-01-20 13:54:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:AkjvRp0g/fKxVXnvUdVYk1HmyFtEP/2xn/8f7dwWS4X3RS5Y6jDZ2yRjbRCbw7ki:bjz0h5iN15tk2Wf7dhXhS5YQsANKhtm
TLSH 50453384E0FB9A48AF6425D71D64AED33082C467A0BB5E06E87FA552452E5CF0F1AF13
Reporter abuse_ch
Tags:xz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: Eng. Elias Hanna <oktaykucuk@karatguc.com>
Subject: NEW ORDER-09098787
Attachment: 000000090000-0990.xz (contains "000000090000-0990.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.362040.14178.16672.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/317fec4108f6d85caa5c1589b983a87dc665140390975d2f96e54a8ab1ab2d34/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2021-01-20 11:07:32 UTC
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gf76yqii63mfzks4cwe3ta5ipxdgkfadsclv2l4w4vfivmnlfu2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/317fec4108f6d85caa5c1589b983a87dc665140390975d2f96e54a8ab1ab2d34

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 317fec4108f6d85caa5c1589b983a87dc665140390975d2f96e54a8ab1ab2d34

(this sample)

SnakeKeylogger

Executable exe c62943499b7fed80bf4e37ab525b622ef4fb7cc6b82ddb7b8d6fe75dabcaf363

  
Dropping
MD5 dca3732857d10782f68df4c3e1b757a9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c62943499b7fed80bf4e37ab525b622ef4fb7cc6b82ddb7b8d6fe75dabcaf363

Comments