MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d9a9f731c24374bf9baa53d488276921ef3beb1713473a61a21f9d61b6ae0db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d9a9f731c24374bf9baa53d488276921ef3beb1713473a61a21f9d61b6ae0db
SHA3-384 hash: 5bdaa94ec64c63e9d11f5ab75f0f9e68eb016169ca49ccd6f87b6aa98e669e3ae242c70da1d51fb8a522bc8491d72bef
SHA1 hash: 1da5c4f74fad9a27f966baaad0af7be4b7890b7b
MD5 hash: 4fe3676c260e160c6ae9704be33fe0f9
humanhash: magazine-william-king-hot
File name:Yeni siparis _WJO-001, pdf.iso
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'071'104 bytes
First seen:2021-04-07 11:21:22 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:z2jSJg6C1B5yUybdpzbWrGt6WFxfzuPa/GMdVIlWpk:z2jYAJybzSPa/GMH
TLSH 9D35F15135AC8BC2E07E1B725866A02113F0799EE36AD50E7DCDB3DE26B3741016FB29
Reporter abuse_ch
Tags:geo iso SnakeKeylogger TUR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: pve03-mail01.stuenings.de
Sending IP: 116.202.61.49
From: Rüya <info@taca.com.tr>
Subject: Yeni sipariş _WJO-001
Attachment: Yeni siparis _WJO-001, pdf.iso (contains "Yeni siparis _WJO-001, pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts66.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d9a9f731c24374bf9baa53d488276921ef3beb1713473a61a21f9d61b6ae0db/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 11:22:08 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jwnj64y4eq3ux6n2uu6uratwsipphpvroe2hhjq2eh45mg3k4dnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4d9a9f731c24374bf9baa53d488276921ef3beb1713473a61a21f9d61b6ae0db

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso 4d9a9f731c24374bf9baa53d488276921ef3beb1713473a61a21f9d61b6ae0db

(this sample)

SnakeKeylogger

Executable exe 68f83609f52852e015998cb4b865378e0de932f9f7ae6238d0083ef1843c4792

  
Dropping
MD5 032ced3f63b6d66f82494674d5b3c44b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 68f83609f52852e015998cb4b865378e0de932f9f7ae6238d0083ef1843c4792

Comments