MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37c8bc8de3743599e1cfffc1af1a253fbb23712e17d6f27f0596b0be707699c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37c8bc8de3743599e1cfffc1af1a253fbb23712e17d6f27f0596b0be707699c2
SHA3-384 hash: fba688348bd8a369b655e33537e7bea4d5e0f156d62418ad02d0e8ed8f1a2e5a216e4ff771d9c3cd4bbbe16116a000f9
SHA1 hash: 39dfdb5e155750c7fb5eb938859d5846268992e6
MD5 hash: ba175623e54c56e6c667c8fae0a967bd
humanhash: william-salami-minnesota-saturn
File name:DHL CONSIGNMENT NOTIFICATION_pdf.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:471'288 bytes
First seen:2021-04-30 12:54:43 UTC
Last seen:2021-04-30 13:00:57 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:mnVDolmOivSZlklSZ7OMfgouMwjOibb8tqzQ0M7VtCkueEu:melm07k0ZjgXlb4MQ08VEnef
TLSH 0AA423061A16195B7FDC8875F20F029CE94C2329E862BF7F3259602352D45B5B8FE3AC
Reporter cocaman
Tags:DHL rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?REhMIEV4cHJlc3MgSU5Dwq4=?= <support@819.mxsen.ml>" (likely spoofed)
Received: "from hp0.819.mxsen.ml (hp0.819.mxsen.ml [138.68.55.226]) "
Date: "30 Apr 2021 05:31:44 -0700"
Subject: "DHL CONSIGNMENT NOTIFICATION: AWB 9899691012 Clearance Doc"
Attachment: "DHL CONSIGNMENT NOTIFICATION_pdf.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37c8bc8de3743599e1cfffc1af1a253fbb23712e17d6f27f0596b0be707699c2/
Threat name:
ByteCode-MSIL.Spyware.Tefosteal
Create hunting rule
Status:
Malicious
First seen:
2021-04-30 08:01:52 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 47 (40.43%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7elzdpdoq2ztyop77a26grfh65sg4joc7lpe7yfs2yl44dwthba._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210430-4nbpzf98g2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/37c8bc8de3743599e1cfffc1af1a253fbb23712e17d6f27f0596b0be707699c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 37c8bc8de3743599e1cfffc1af1a253fbb23712e17d6f27f0596b0be707699c2

(this sample)

SnakeKeylogger

Executable exe 8346b4b66475749310a488fd8af9846f76269e369cba23c9e4615318fcca6aed

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8346b4b66475749310a488fd8af9846f76269e369cba23c9e4615318fcca6aed
  
Dropping
SnakeKeylogger

Comments