MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40403ed385bff4768d5f1d34a9abb7fd39288086320a5fd2863640d5da458922. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40403ed385bff4768d5f1d34a9abb7fd39288086320a5fd2863640d5da458922
SHA3-384 hash: 7afceebd01526b872f56ca78f23fd1cf7ad9448312b10c9b36321e4536eb9f4274f6ee81f5f0475c8ac1ef5ac24e2669
SHA1 hash: a905317f3dbb9327a0f2cd3e025603b32d5d7dcd
MD5 hash: 62b2c932bbef3b773623fa7bef18b605
humanhash: golf-princess-ohio-bakerloo
File name:purchase order.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:524'656 bytes
First seen:2021-02-23 15:55:04 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:RsS20IJn7jC/ZOHF4uXUhaqHIFRXCskORto0CBM1CqaqR14JD3/Si6hLfScQs:RsmIJ7E2bCGq0CBWadzIf
TLSH 59B43311F5DBE5615E65BC34722B39C1FE6229A8A1FE36402052B2713FB77A5CAE1330
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: vps.tecp0s.com
Sending IP: 203.159.80.121
From: office1@tecp0s.com
Subject: PO.
Attachment: purchase order.gz (contains "purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40403ed385bff4768d5f1d34a9abb7fd39288086320a5fd2863640d5da458922/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 15:55:10 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibad5u4fx72hndk7du2ktk5x7u4sraeggiff7uuggzanlwsfrera._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/40403ed385bff4768d5f1d34a9abb7fd39288086320a5fd2863640d5da458922

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 40403ed385bff4768d5f1d34a9abb7fd39288086320a5fd2863640d5da458922

(this sample)

SnakeKeylogger

Executable exe efb8a6ee35a58b95c2940653c47b3a10efd0d46c1bd622ce2924f36f1765cda7

  
Dropping
MD5 4e94325d3550f456123ade2609ebb4a5
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 efb8a6ee35a58b95c2940653c47b3a10efd0d46c1bd622ce2924f36f1765cda7

Comments