MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ae023779bcb29f75fa4eb1ad0b1c8f8dda4c8187c184d802e81e19a543e4dd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	3ae023779bcb29f75fa4eb1ad0b1c8f8dda4c8187c184d802e81e19a543e4dd9
SHA3-384 hash:	9795f15bea1dd7bf0a1914342c1b19e68dc97435308df57d903c17f2ff203d7fe55f8681a96948e85ced08cb406707c9
SHA1 hash:	19e2c8694f04b60a5e07b175c2a498af71cc95c5
MD5 hash:	0ecbfde3c99e1c9135856f3ff325328b
humanhash:	ack-hawaii-ack-colorado
File name:	Swift Copy TT USDUSD$23,401.PDF.r05
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	732'578 bytes
First seen:	2025-02-06 08:19:08 UTC
Last seen:	Never
File type:	r05
MIME type:	application/x-rar
ssdeep	12288:zsprIBYW5HibCjxqCdWOrkmUlhabZQd2TnM5CCGhogXWMzgsNJZ92eHr8g+lRaQf:oprYbi2jkC3UUud2TnIGhowdrNJBL8gG
TLSH	T1D1F423E77488DCB5B98D9C8DF843434224BE17336D4418CD7AA2F7CFE2649F19A82619
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	r05 SnakeKeylogger SWIFT

cocaman

Malicious email (T1566.001)
From: "Shah Hasan <shah.mmw@gmail.com>" (likely spoofed)
Received: "from [45.144.212.195] (unknown [45.144.212.195]) "
Date: "5 Feb 2025 23:24:21 -0800"
Subject: "Swift Advice for USD$23,401 to lgpartner.ch - 1ST transfer for 280ECH"
Attachment: "Swift Copy TT USDUSD$23,401.PDF.r05"

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a4718b51193558eb198a9d

Tags:

virus sage msil

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/3ae023779bcb29f75fa4eb1ad0b1c8f8dda4c8187c184d802e81e19a543e4dd9

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3ae023779bcb29f75fa4eb1ad0b1c8f8dda4c8187c184d802e81e19a543e4dd9/

Threat name:

ByteCode-MSIL.Trojan.Zmutzy

Status:

Malicious

First seen:

2025-02-06 07:57:15 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

12 of 38 (31.58%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hlqcg543zmu7ox5e5mnnbmoi7do2jsaypqme3aboqhqzuvb6jxmq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3ae023779bcb29f75fa4eb1ad0b1c8f8dda4c8187c184d802e81e19a543e4dd9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)