MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32aa1ec796bb172a90e04779079658b95a385849382d8b98fa0ea8fccdd992bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32aa1ec796bb172a90e04779079658b95a385849382d8b98fa0ea8fccdd992bb
SHA3-384 hash: 5955e594628ed57f7ff5853a1ac5c2811b897c644747f2b0aed0d1d28779a56c5e0897f8232ce1462e8439c6f6f6b820
SHA1 hash: 0e703cf606d2753edd5400098bcf318e63fdba64
MD5 hash: d62183bbe9fb12ff2b3e28d47d36b41a
humanhash: fruit-emma-lake-nitrogen
File name:McDERMOTT STANDARD TERMS AND CONDITIONSInclusive of Appendix Kakinada - R01862322.img
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'769'472 bytes
First seen:2021-02-18 06:49:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:vX2map3Mj6jRPLjRPqjBjjyjBjBjBjBjLjbJJYpekFFFEOmW2UyJ21aN0F3h2A6W:vmvzkFFFHRjx/l5D
TLSH 9B8505441EA44A01FC6D6B384155D031D3BEBDD69672C2AD29C63C9B39F3E819F26E0E
Reporter abuse_ch
Tags:img SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: fi.fiercegauge.live
Sending IP: 45.95.168.180
From: Venkata Krishna <vkoripella@mcdermott.com>
Subject: RFQ for supply of Swagelok fittings for CFM Tooling integration of KGD6 Project, Kakinada - R01862322
Attachment: McDERMOTT STANDARD TERMS AND CONDITIONSInclusive of Appendix Kakinada - R01862322.img (contains "McDERMOTT STANDARD TERMS AND CONDITIONS(Inclusive of Appendix Kakinada - R01862322.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.1929.21345.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32aa1ec796bb172a90e04779079658b95a385849382d8b98fa0ea8fccdd992bb/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 04:28:58 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkvb5r4wxmlsvehai54qpfsyxfndqwcjhawyxgh2b2upztozsk5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/32aa1ec796bb172a90e04779079658b95a385849382d8b98fa0ea8fccdd992bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 32aa1ec796bb172a90e04779079658b95a385849382d8b98fa0ea8fccdd992bb

(this sample)

SnakeKeylogger

Executable exe 9ee1bd8d321c0f2b59c8d9005f174cfdee3476d00f5fa9005655d0ca6bb22afd

  
Dropping
MD5 f0f1583895386c2bf77a4fdee48fc4cf
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9ee1bd8d321c0f2b59c8d9005f174cfdee3476d00f5fa9005655d0ca6bb22afd

Comments