MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f547f553540fe1703af427ae21d481b1626f702277799f5f909dc0cbe587cb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f547f553540fe1703af427ae21d481b1626f702277799f5f909dc0cbe587cb6
SHA3-384 hash: 92dc3427006eb918af0358a13d3e5e03ec51656be752e3bacc51b675c7e390e96e7bdf86ee49c7778746acbbc215dfe6
SHA1 hash: ad255830d78c61280bcf7f7b578145428fc2181c
MD5 hash: 2d5a96bdf8bdc3107fe8c044a880d3d8
humanhash: texas-east-wolfram-aspen
File name:00404000004.UUE
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:232'492 bytes
First seen:2021-06-10 05:44:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:N6DBwukf4p2fwsGqlVBzO9mz7S9N+xqaCUx1j0i1:N6DBwukjwLQtz7CNqKUx1gu
TLSH 043423A1F083CC555E90E4596578677ACCDEE5E0FFADA039FB160219E41FE4E42B1E08
Reporter cocaman
Tags:SnakeKeylogger uue zip


Avatar
cocaman
Malicious email (T1566.001)
From: "elifkardes@gmail.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.58.136]) "
Date: "9 Jun 2021 21:32:26 -0700"
Subject: "=?UTF-8?B?5paw5o6h6LO86KiC5Zau77yaNDgwMTA0NzM=?="
Attachment: "00404000004.UUE"

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

SecuriteInfo.com..194.17770.UNOFFICIAL
Create hunting rule

PUA.Win.Trojan.Casino-141
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3f547f553540fe1703af427ae21d481b1626f702277799f5f909dc0cbe587cb6
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f547f553540fe1703af427ae21d481b1626f702277799f5f909dc0cbe587cb6/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-06-10 05:44:12 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h5kh6vjvid7boa5pij5oehkidmlcn5yce53zt5pzbhoazpsyps3a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210610-bexsnf253j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/3f547f553540fe1703af427ae21d481b1626f702277799f5f909dc0cbe587cb6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 3f547f553540fe1703af427ae21d481b1626f702277799f5f909dc0cbe587cb6

(this sample)

SnakeKeylogger

Executable exe 92517b173ea0fcaebaaa41bb74ac2dbf25b826b35bc3dc3735e1091ae0d4fe85

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92517b173ea0fcaebaaa41bb74ac2dbf25b826b35bc3dc3735e1091ae0d4fe85

Comments