MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 362f9b21d37345c858157f92aa6e7e3ffbefe99399ea63e3dc2592c25150c26b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 362f9b21d37345c858157f92aa6e7e3ffbefe99399ea63e3dc2592c25150c26b
SHA3-384 hash: 8a8a6bd2cc0b213b09b404bdd5d7af8f46af5d95cc4eed64936f281e5931c8cb664a6473f9d768264d48f522a9b97759
SHA1 hash: 60e2e3d567b1709bcefd0a4db0772253183eac6c
MD5 hash: 658a2215f2cbc1cb3886c133c1ea3aca
humanhash: missouri-charlie-nitrogen-alabama
File name:WaybillDoc_2396752890.pdf.r00
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:383'751 bytes
First seen:2021-02-23 16:01:23 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:fcz8vJegGgHlf9gfiHrnyaGqxC/RSGg7vzCDXzqZlFqyQh0mfjQkxiGGK5Y2IL1C:fciNPHlf9pLjG9/RXazyGZfqyhmfjQkR
TLSH 0C8423631881B640C7AB4AFF7E43DF49C27B213DB820A6CD625E53F3E4F92A56516360
Reporter abuse_ch
Tags:DHL r00 SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: mail.cdkhost.com
Sending IP: 185.9.156.116
From: "Tolga Çiftçioglu" <okan@ankatemizlik.net>
Subject: FW: VWR (AVANTOR) KOLLUK - DHL
Attachment: WaybillDoc_2396752890.pdf.r00 (contains "WaybillDoc_2396752890.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/362f9b21d37345c858157f92aa6e7e3ffbefe99399ea63e3dc2592c25150c26b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 16:02:10 UTC
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gyxzwiotonc4qwavp6jku3t6h75672mtthvghy64ewjmeukqyjvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/362f9b21d37345c858157f92aa6e7e3ffbefe99399ea63e3dc2592c25150c26b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

r00 362f9b21d37345c858157f92aa6e7e3ffbefe99399ea63e3dc2592c25150c26b

(this sample)

SnakeKeylogger

Executable exe e57d7f1f574848367ff41a17c2ce5ba96483332aeadfc0c09fe9e609ad9a87a3

  
Dropping
MD5 d5251dc4ed524754ed1b27ce12e2298c
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e57d7f1f574848367ff41a17c2ce5ba96483332aeadfc0c09fe9e609ad9a87a3

Comments