MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36c45cff2751d1a904b4bb066a21f23b713b1ae4f59a26a2d46da9a1c4069f3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36c45cff2751d1a904b4bb066a21f23b713b1ae4f59a26a2d46da9a1c4069f3f
SHA3-384 hash: c3e35bd588d882bf17d24328fe545b7a23c39b3fcc1a4b000385623b841034afc0c9862ec300141d7c6179def167f49b
SHA1 hash: 1eb0a2e5e8cfc68705a02e4a3bd34e8e650c0c34
MD5 hash: 33e0e9dc517e7a3f89b6dcf9b20a239b
humanhash: hotel-mobile-hotel-stairway
File name:purchase order.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:681'569 bytes
First seen:2021-02-03 16:06:26 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:XkueVRa+ARwl2ozvil126hYTd8V8Rt1c60k/uRS1eJenGHMAcL+SyDTUAWCh0WB0:Xxeznl2o6kVmVCtm6BmE1IvqFyXgLB
TLSH BDE433B14B180871F832C3A953B11DE2787CEB47CA3E45B36649E90906C8DE7E72655F
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.zenk0h.com
Sending IP: 203.159.80.108
From: Purchase <alsumood@emirates.net.ae>
Subject: RE: New Order PO
Attachment: purchase order.gz (contains "purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36c45cff2751d1a904b4bb066a21f23b713b1ae4f59a26a2d46da9a1c4069f3f/
Threat name:
Win32.Backdoor.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-03 16:07:10 UTC
AV detection:
5 of 45 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g3cfz7zhkhi2sbfuxmdguipshnytwgxe6wncniwunwu2dragt47q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/36c45cff2751d1a904b4bb066a21f23b713b1ae4f59a26a2d46da9a1c4069f3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 36c45cff2751d1a904b4bb066a21f23b713b1ae4f59a26a2d46da9a1c4069f3f

(this sample)

SnakeKeylogger

Executable exe 5fe4bb5f46323974d50cf7d3318c804c148f3fce60e5d6c0b7e2fb49c97af7e1

  
Dropping
MD5 ce13d1bcd6919436d6656bc9cccde0fc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5fe4bb5f46323974d50cf7d3318c804c148f3fce60e5d6c0b7e2fb49c97af7e1

Comments