MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e38e3d0a442ea94f31e31b53084f904ab45661dc50c9abec49c0a016dea64a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e38e3d0a442ea94f31e31b53084f904ab45661dc50c9abec49c0a016dea64a4
SHA3-384 hash: 31727a7b9fb6fdc8748036db10456180c81dd2c6510e640f4ea2dae5b2b678b2337fb74fcd01ed8bd9e208a857d6c166
SHA1 hash: dbe4c6ea084ebbc0f2263fe8bd1814cb6f87c759
MD5 hash: cc2bcba266b5fa7bccaf7592df6c1837
humanhash: sodium-cardinal-leopard-berlin
File name:(RFQ) - ATTIQ - 10230-2413_TEMPORARY CONSTRUCTION FACILITIES.IMG
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'376'256 bytes
First seen:2021-08-10 12:15:08 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:pZKKsn3qGaNHEyC9/oR9gy5FHK7zUXbmiE+JKTNAOhPI5l1yt8jKOhTNMxst1bHH:pZKKUPp9AR95yAivxtwlwdgMxGp9
TLSH T1B755024B23805353C015EB3B5499A35306B5EEE5DBA2EED9788B353E1EE6301DE02B53
Reporter cocaman
Tags:img SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "David Gomez <dagomez@tecnicasreunidas.es>" (likely spoofed)
Received: "from mail.swan-manila.com (mail.swan-manila.com [206.189.73.24]) "
Date: "Tue, 10 Aug 2021 09:13:25 +0200"
Subject: "(RFQ) - ATTIQ - 10230-2413_TEMPORARY CONSTRUCTION FACILITIES-TWO WAREHOUSES AND OTHERS - MARJAN INCREMENT PROGRAM TANAJIB GAS PLANT PROJECT - PACKAGES 09 AND 11"
Attachment: "(RFQ) - ATTIQ - 10230-2413_TEMPORARY CONSTRUCTION FACILITIES.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.2343.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e38e3d0a442ea94f31e31b53084f904ab45661dc50c9abec49c0a016dea64a4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-10 05:06:50 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ly4ohufeilvjj4y6gg2tbbhzasvukzq5yugjvpwetqfac3pkmssa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/5e38e3d0a442ea94f31e31b53084f904ab45661dc50c9abec49c0a016dea64a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 5e38e3d0a442ea94f31e31b53084f904ab45661dc50c9abec49c0a016dea64a4

(this sample)

SnakeKeylogger

Executable exe e61a3b81de7fce074598eb722f5d11e2ccd26032eadfc0d7f2170b03e02a2b79

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e61a3b81de7fce074598eb722f5d11e2ccd26032eadfc0d7f2170b03e02a2b79

Comments