MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47d3768a194c474fd25e1156391c84fefb84ad1c47d4dee3fc08fbf7cfebfbda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47d3768a194c474fd25e1156391c84fefb84ad1c47d4dee3fc08fbf7cfebfbda
SHA3-384 hash: 9d559c6fbdc6c40f65843a8cda89b9e4e492fd39cef606106efd14c2195c7b0b0b081a828b7d60ab6e6b69151c489d32
SHA1 hash: 758daaf6ce9d8f6ae304d57321e03b27b1960820
MD5 hash: 21c3d7668611d419c77c0744b171bac6
humanhash: double-mountain-hydrogen-yellow
File name:V13145 Order PO-224005.lzh
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:639'561 bytes
First seen:2021-08-18 06:02:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:msvEElCnRUJ+spsiu8CyB7jxrTOCcUvaIQpD4rQgqy2Oq/+yS8Ti78HgJ:msMEcnqvxjx/zaIQpsxChS8Ti7sgJ
TLSH T11FD4236A1571BD15157968FEAF8AEBFD3246CF3E2619C02EF362077D701BE2209124B1
Reporter cocaman
Tags:lzh rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Belas Spa <info@belasspa.com>" (likely spoofed)
Received: "from belasspa.com (unknown [185.222.58.146]) "
Date: "18 Aug 2021 06:54:43 +0200"
Subject: "Purchase Order PO-224005"
Attachment: "V13145 Order PO-224005.lzh"

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47d3768a194c474fd25e1156391c84fefb84ad1c47d4dee3fc08fbf7cfebfbda/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 04:35:23 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7jxncqzjrdu7us6cfldshee735yjli4i7kn5y74bd57pt7l7pna._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210818-5jgfzk8n2n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/47d3768a194c474fd25e1156391c84fefb84ad1c47d4dee3fc08fbf7cfebfbda

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 47d3768a194c474fd25e1156391c84fefb84ad1c47d4dee3fc08fbf7cfebfbda

(this sample)

SnakeKeylogger

Executable exe 60bc83d86c495e11d556ff933414008ed8228d9c2060fc18e230dea899e46edf

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60bc83d86c495e11d556ff933414008ed8228d9c2060fc18e230dea899e46edf
  
Dropping
SnakeKeylogger

Comments