MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58013d8cc40a01c6b5f99fd33b70c89f5b3f588e006e49a57be26105535aaef6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58013d8cc40a01c6b5f99fd33b70c89f5b3f588e006e49a57be26105535aaef6
SHA3-384 hash: 178c5e5ca603b8005dda509c3dea6d7f77dd82bd19669e63751f9081ea33027dfb84547fc679b4e84e97700eb8b5e509
SHA1 hash: c0b01a9acc4d35aac0c11cfd81fe833f09bef63f
MD5 hash: af9dbba26a0a2f1a47d0b51fa97c4331
humanhash: triple-burger-december-paris
File name:P.O_WJO-002_pdf.lz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:535'527 bytes
First seen:2022-06-06 07:51:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:8a8LnqdrAnT3No2sl1Wz+t8GmhCJlUZKtcly/BgLR35ZwuzC8:18LqlA5ovxChCxiBV5hC8
TLSH T1D7B423348ED06ACA118BF9CB57566A0BEC2EDC0016B6578038952119DFD3D8FB3986DF
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:lz rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Grzegorz Sowa <sales@jacefay.ml>" (likely spoofed)
Received: "from jacefay.ml (unknown [45.137.22.42]) "
Date: "06 Jun 2022 05:50:08 +0200"
Subject: "Attached our formal P/O : 4501226854."
Attachment: "P.O_WJO-002_pdf.lz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58013d8cc40a01c6b5f99fd33b70c89f5b3f588e006e49a57be26105535aaef6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-06 01:33:35 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=laat3dgebia4nnpzt7jtw4git5nt6weoabxetjl34jqqku22v33a._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/220606-jqdr3sega5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/58013d8cc40a01c6b5f99fd33b70c89f5b3f588e006e49a57be26105535aaef6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 58013d8cc40a01c6b5f99fd33b70c89f5b3f588e006e49a57be26105535aaef6

(this sample)

SnakeKeylogger

Executable exe 033ca85b5ee9149729f8b709e5353501e3522d5749971ff3be8ac95802a89dd1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 033ca85b5ee9149729f8b709e5353501e3522d5749971ff3be8ac95802a89dd1

Comments