MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 367b779b6e09c5ed6998e37ce8c22ec744b5563a4b151d7d37f00eb173333ed8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 367b779b6e09c5ed6998e37ce8c22ec744b5563a4b151d7d37f00eb173333ed8
SHA3-384 hash: 3a92298c084555b9576f0ebfd259cd9b2ddebceba0e837f943dbeea5d8524cb059239c09e120e071876e112031560d73
SHA1 hash: a9dc060ba47c2e39317b59e6ae932f22537e4a47
MD5 hash: a4087336fd56841fa3b6d1a56f96304b
humanhash: video-pasta-oklahoma-thirteen
File name:Purchase Order.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:282'080 bytes
First seen:2021-02-05 16:36:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Xr/L8f+e+2eQGxJDQknmq1chQm6yCzrTaa537j8UBXipL:bDO+eqQWJDQ21cQmk597IUBXipL
TLSH 2E5423255ADFF533D07D11B371599F0710813607B89DA6AAA26F241BFB923350FE80B9
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: air.nseasy.com
Sending IP: 64.37.52.73
From: Sales <sales@greenwoodmagnetics.com>
Subject: RE: Purchase Order.
Attachment: Purchase Order.zip (contains "Purchase Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs231.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20845.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/367b779b6e09c5ed6998e37ce8c22ec744b5563a4b151d7d37f00eb173333ed8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 16:36:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gz5xpg3obhc622my4n6orqroy5clkvr2jmkr27jx6ahlc4zth3ma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/367b779b6e09c5ed6998e37ce8c22ec744b5563a4b151d7d37f00eb173333ed8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 367b779b6e09c5ed6998e37ce8c22ec744b5563a4b151d7d37f00eb173333ed8

(this sample)

SnakeKeylogger

Executable exe d2d343134c1059de966b18db5befa9de624af3a60a16c74435c359a6b633d7bd

  
Dropping
MD5 47455e580d7487f9a88a046fb9382bde
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2d343134c1059de966b18db5befa9de624af3a60a16c74435c359a6b633d7bd

Comments