MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44405db054ff74cf816a12d598e22fee73df162403b57c7acbbd7d9563614c1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44405db054ff74cf816a12d598e22fee73df162403b57c7acbbd7d9563614c1f
SHA3-384 hash: 6b314803696cf1a4f4f35a5f3b36e90bab372ddbc790b7f92ac4b8712d789027902ba27ab165556a5db8c14750b58d6d
SHA1 hash: 04b9877e77b52b1dfd684895b896b15b5e79f72e
MD5 hash: 7ccc62da85dcd526970cc5f3bdbbe1a6
humanhash: wolfram-nebraska-cup-south
File name:REQUIRED UPDATED SOA.pdf.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:512'694 bytes
First seen:2021-01-18 07:12:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:G1eJC/vnS4POReTW3zd9ROUH0JD3jZh10LfnoTg5bBVmiV9/ZArox5:NCHCRiWzdbOUUJDzd0LfnEgtfVus
TLSH 4EB423071CDF3FF82D1600B76456B6E453C178EB33AAA89567D0A933ADC24B1C1B25D6
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: yolanda.sh@francovagochina.com
Subject: REQUIRED UPDATED SOA TILL DATE
Attachment: REQUIRED UPDATED SOA.pdf.gz (contains "REQUIRED UPDATED SOA.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Firseria-6804617-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44405db054ff74cf816a12d598e22fee73df162403b57c7acbbd7d9563614c1f/
Threat name:
Win32.Trojan.XetimaLogger
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 07:13:04 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iraf3mcu752m7alkclkzryrp5zz56freao2xy6wlxv6zky3bjqpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44405db054ff74cf816a12d598e22fee73df162403b57c7acbbd7d9563614c1f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 44405db054ff74cf816a12d598e22fee73df162403b57c7acbbd7d9563614c1f

(this sample)

SnakeKeylogger

Executable exe ffd9ef759aa1fbd3370a8410771878b7ae941d0c60c5ce41d705aa18e4e59958

  
Dropping
MD5 ee7673e9718c0ea2c15cc3b75548fea6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ffd9ef759aa1fbd3370a8410771878b7ae941d0c60c5ce41d705aa18e4e59958

Comments