MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56ae2a5fb3ddba3ee1058297932b85462cf657d1bc152aa6453adf4e386730bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56ae2a5fb3ddba3ee1058297932b85462cf657d1bc152aa6453adf4e386730bc
SHA3-384 hash: aec8f0357942fdbda447825852dcdd5b4e45bd692961247af36fe056db2ed77bd39ab94009996c6ef98a93ba4a004dfe
SHA1 hash: dfd9608394a7041c39ab5a36e7eddf1cc2a76119
MD5 hash: 83b8edd6c8bdc31aef30e933072e02a1
humanhash: island-mike-lima-eleven
File name:Purchase Order.9000.scan.pdf..z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:828'079 bytes
First seen:2021-04-06 08:17:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:jzrBTUy33PAms78hg0WllZBnZvvNd7pTiE6:NUYxSGel5npIE6
TLSH E00523A97B03EAED34914EADB5B39391C60197FA304D984DE003729F0D7F9A069C1E59
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.244
From: nguyen.thi.bich.thao@vinicorp.com.vn
Subject: Attached our required sample
Attachment: Purchase Order.9000.scan.pdf..z (contains "Purchase Order.9000.scan.pdf...exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_Hideexe.5.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/56ae2a5fb3ddba3ee1058297932b85462cf657d1bc152aa6453adf4e386730bc
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56ae2a5fb3ddba3ee1058297932b85462cf657d1bc152aa6453adf4e386730bc/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 08:17:07 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2xcux5t3w5d5yifqklzgk4fiywpmv6rxqksvjsfhlpu4odhgc6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56ae2a5fb3ddba3ee1058297932b85462cf657d1bc152aa6453adf4e386730bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 56ae2a5fb3ddba3ee1058297932b85462cf657d1bc152aa6453adf4e386730bc

(this sample)

SnakeKeylogger

Executable exe db2bb3876a40bbde8eeb7416ffeba8daa35bc6cc4af24fcb440cc57effe904fa

  
Dropping
MD5 dfe7743816c89939255dbf1e327bfbb9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db2bb3876a40bbde8eeb7416ffeba8daa35bc6cc4af24fcb440cc57effe904fa

Comments