MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39506bc6b6835299cdbaa83206b3a1e0ab001966ca37c619536707b9ae6e6899. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39506bc6b6835299cdbaa83206b3a1e0ab001966ca37c619536707b9ae6e6899
SHA3-384 hash: 6cddc3cbbba6771304f8934e987320d2f222ab2673bc69dc4d91b9335f148893fcfdbda7f9e4bd754a6017e3dd76db8a
SHA1 hash: b204c8a529e1d62b26b057c167ffea1a0321b8f2
MD5 hash: 480e2d247a3b52ab7e0cfdae7fc78756
humanhash: edward-bluebird-winner-robin
File name:090800000000000000.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:647'825 bytes
First seen:2020-12-25 07:59:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:G/aJzkLgJX0rT5MD5tpoh6f8o6WYmCtM5mJ7pemq7rg5kqCnQblgZI/Cu29b8um:GCJegx0hMDRbf8rHmf5mJNly8yfQbl68
TLSH F8D4237F0040F2A1F3341F5B5A62F828DE78A162779A0D06263CCB8BAF4B9A53C5D755
Reporter abuse_ch
Tags:geo VNM zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: alistekstil.com
Sending IP: 45.137.22.52
From: sales@alistekstil.com
Subject: Đơn đặt hàng / Đơn đặt hàng (Số đơn đặt hàng / Số đơn đặt hàng: 74637)
Attachment: 090800000000000000.zip (contains "090800000000000000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
854
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_justnumexe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39506bc6b6835299cdbaa83206b3a1e0ab001966ca37c619536707b9ae6e6899/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-25 08:00:07 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hfigxrvwqnjjttn2vazanm5b4cvqaglgzi34mgktm4d3tltoncmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.43
Link:
https://yomi.yoroi.company/submissions/39506bc6b6835299cdbaa83206b3a1e0ab001966ca37c619536707b9ae6e6899

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 39506bc6b6835299cdbaa83206b3a1e0ab001966ca37c619536707b9ae6e6899

(this sample)

SnakeKeylogger

Executable exe a8fd70d495674b3da68cc393c67235daa2ea27475119ab9b5d6b247f7fa65399

  
Dropping
MD5 482d5806bdb0c6973deb14e7b371ca3c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a8fd70d495674b3da68cc393c67235daa2ea27475119ab9b5d6b247f7fa65399

Comments