MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4411b1f408e1224702116f67b0b30765053b41015286c22b3e521cec5aeaaae6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4411b1f408e1224702116f67b0b30765053b41015286c22b3e521cec5aeaaae6
SHA3-384 hash: 98197d401fed4858205d06805b1bc223fbcae6ab385e63739f354dfe2d6e0aa38bc1cddfa0cd5409407bdcfb72d78bf4
SHA1 hash: 086143d2c1c810b66538ada877da42e3a4e40918
MD5 hash: 2da4bebc74716bb217eac95e1e5788a6
humanhash: nineteen-lion-fifteen-hydrogen
File name:00098765_INV.r09
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:232'081 bytes
First seen:2021-02-08 14:42:15 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 6144:ss0xuCtsaZa4zmIef77P9o6wxh6JvNwVS/Hp6Wq7T1a1HT:sHuCt+z97DFwxUX5/H07J6HT
TLSH 3B3423DA3D663FC7451C4E875296A4EAEC2CE48842811479DB0D4FAEF34E091BB9F432
Reporter abuse_ch
Tags:r09 SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: secureserver.digitaledgekenya.com
Sending IP: 148.251.164.94
From: Ms.Thanathip Chonthawornpong | Lung (陳佩蘭) <mike@howw.com>
Subject: RE: PAYMENT SWIFT COPY FOR = USD 80,950.25
Attachment: 00098765_INV.r09 (contains "00098765_INV.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4411b1f408e1224702116f67b0b30765053b41015286c22b3e521cec5aeaaae6/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 08:00:34 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iqi3d5ai4ereoaqrn5t3bmyhmuctwqibkkdmekz6kiooywxkvlta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4411b1f408e1224702116f67b0b30765053b41015286c22b3e521cec5aeaaae6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

r09 4411b1f408e1224702116f67b0b30765053b41015286c22b3e521cec5aeaaae6

(this sample)

SnakeKeylogger

Executable exe cc53056d783515978f191ef41c9817341026f4f68e78a4d2bde8392d03c4256c

  
Dropping
MD5 5a8e256d94dbb3028e46c5b1c78b8f9a
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc53056d783515978f191ef41c9817341026f4f68e78a4d2bde8392d03c4256c

Comments