MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 342e4b336ab0d8f3ed404ceaca87514d2ef2bfbfebda25699f9abf9e5c6242a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 342e4b336ab0d8f3ed404ceaca87514d2ef2bfbfebda25699f9abf9e5c6242a0
SHA3-384 hash: 3590a9d28ba7156e78edfd8a80391964bf612a4489aaa6baf6ac775da949ad38c7744c14a770005292980caa18f921fc
SHA1 hash: b6671f768aba516083064894ed7a93253e311049
MD5 hash: 6bf27cc62a19929acc886e7b02b0290b
humanhash: moon-harry-october-wisconsin
File name:PRODUCT CTG. ORDER.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:609'677 bytes
First seen:2021-03-12 15:02:41 UTC
Last seen:2021-03-12 15:56:36 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:cXHAb2QR4Ll/n8zavlPC0N+qBw43qNK0Ld4gwiy8UiYCFPyN4jMh:/RKBPPlNVwe8K+XM8UjayCjy
TLSH 89D433F047EE2DF076E36AE2FE6D26F0AE78721C6617700BD948C7B0C45A456958530B
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
2
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.570.9462.17692.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/342e4b336ab0d8f3ed404ceaca87514d2ef2bfbfebda25699f9abf9e5c6242a0/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 06:36:42 UTC
AV detection:
26 of 47 (55.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqxewm3kwdmph3kajtvmvb2rjuxpfp575pnck2m7tk7z4xdcikqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/342e4b336ab0d8f3ed404ceaca87514d2ef2bfbfebda25699f9abf9e5c6242a0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 342e4b336ab0d8f3ed404ceaca87514d2ef2bfbfebda25699f9abf9e5c6242a0

(this sample)

SnakeKeylogger

Executable exe 26d4045f98b32e12d3fc1318a6933fa2b83a5e9e890d3a87a27e241e497646ea

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 26d4045f98b32e12d3fc1318a6933fa2b83a5e9e890d3a87a27e241e497646ea
  
Dropping
MD5 5cc544ea19d43bcfc57fc2691d4254b7

Comments