MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61ef9a54dcb38d28b2907e3c0b2c07d50308c7d2837a01c5df7de04060b58dc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61ef9a54dcb38d28b2907e3c0b2c07d50308c7d2837a01c5df7de04060b58dc0
SHA3-384 hash: 0288bee812c067621847f09974473ee1022779d906bf82e8f2ee881d0b93d3b6b002ce65bf2610860dfecf3d1b96ec8d
SHA1 hash: 4835da13c1fc2ee52314a7f5532bb6dda36d1336
MD5 hash: 348d013e4a8fa3864bfde3598003b7fa
humanhash: mike-muppet-cat-nevada
File name:PO202100046.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:387'969 bytes
First seen:2021-02-23 16:25:52 UTC
Last seen:2021-02-26 18:03:41 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:WroQDvTklZRKrmYMH2c1EVlyd4dM9GVxwZfm09TNR3qxiLlA1bjhC6gBZUUp5IRc:WroQbTmYMH2cEGKdMhZRJA13hZgBZnpf
TLSH EB8423EDF83808C9DAFD364687B5D99EF9405D72AE524C6460E9BB81C2F644D0E02BF0
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: goldentech.com
Sending IP: 172.93.187.131
From: salaatmoss <tmoss@goldentech.com>
Reply-To: sales4@cnqlt-com.cf
Subject: New order
Attachment: PO202100046.zip (contains "PO202100046.exe")

Intelligence

File Origin
# of uploads :
7
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61ef9a54dcb38d28b2907e3c0b2c07d50308c7d2837a01c5df7de04060b58dc0/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 15:41:41 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhxzuvg4wogsrmuqpy6awlah2ubqrr6sqn5adro7pxqeayfvrxaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/61ef9a54dcb38d28b2907e3c0b2c07d50308c7d2837a01c5df7de04060b58dc0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 61ef9a54dcb38d28b2907e3c0b2c07d50308c7d2837a01c5df7de04060b58dc0

(this sample)

SnakeKeylogger

Executable exe 77ee17838c1ea6e3c69ec2989df485386800901ef0caac90e01fadbad225a354

  
Dropping
MD5 eafc433b4d4bf4a0edc9b57b6f4af8ec
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77ee17838c1ea6e3c69ec2989df485386800901ef0caac90e01fadbad225a354

Comments