MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 406161058cd5896d3fe2562e09fbbe2e143175ae2398b6b77d5441044524cbd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 406161058cd5896d3fe2562e09fbbe2e143175ae2398b6b77d5441044524cbd8
SHA3-384 hash: 940a314945f5627764e8ffd8320ba85d3d060a0e877038815241427cf3bbbc32d74ee6dddbaccfbcbcf463d7840aeaf8
SHA1 hash: b2ab55046c2b69a907b65206c925baa074903d1d
MD5 hash: 53fc3581ad80718c68ee8e26d013f260
humanhash: wisconsin-sink-fillet-california
File name:PRODUCT CTG. ORDER 1.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:645'574 bytes
First seen:2021-03-03 06:16:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:n+zpEEwnZSfPlZYBYydF582/q/PuPBvKtlYH7Nj:+zpEEESfPlEF/yeMtlYN
TLSH 36D4234618256F029AFE952713EEB17172ACCC97398F16A90D35A1283CFD0568C97ECF
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

From: codink@sealcode.com
Subject: New Purchase Order 2200041757
Attachment: PRODUCT CTG. ORDER 1.zip (contains "PRODUCT CTG. ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/406161058cd5896d3fe2562e09fbbe2e143175ae2398b6b77d5441044524cbd8/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 00:34:16 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibqwcbmm2wew2p7ckyxat656fykdc5noeomlnn35kraqirjezpma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/406161058cd5896d3fe2562e09fbbe2e143175ae2398b6b77d5441044524cbd8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 406161058cd5896d3fe2562e09fbbe2e143175ae2398b6b77d5441044524cbd8

(this sample)

SnakeKeylogger

Executable exe ba748b6ea1dda915d5803c29e789e34eb04a1768a60ff13647106d057f817f96

  
Dropping
MD5 7ebdb82d1f89142743c1109b06883d35
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ba748b6ea1dda915d5803c29e789e34eb04a1768a60ff13647106d057f817f96

Comments