MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6378b34b82f8b76125969b6932758177e0b4c04a2080f334ce5846a6eeab3ac3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6378b34b82f8b76125969b6932758177e0b4c04a2080f334ce5846a6eeab3ac3
SHA3-384 hash: 0f548a080e6419bb2a1449e05c770d95eda714039bfb3adf8295dfd4ecefaf3900c69c5d8f2eec2fc37fcc99820dcbbb
SHA1 hash: f5fd612c4590de4a7289f459256cabb60f37e951
MD5 hash: 8dc38cbcc8a441f722a8967923a850b4
humanhash: freddie-virginia-river-skylark
File name:telex transfer.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:9'347 bytes
First seen:2021-03-04 07:28:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 192:2+mVSfPqqONpKZ13uzVGNR/Z3azavRKgacL+C6agwEiLfJHM18yjbg:2/VsCfXo/kzavAMEwEcfxM1JHg
TLSH 6112C068C80E92C7D34A8AF61CA101D33A7D25F7C539345CF87DA6DC502D548381CE45
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cl-t002-054cl.privatedns.com
Sending IP: 64.15.155.21
From: smtp-h3asi@australiastartups.org
Subject: Telex transfer (TT)
Attachment: telex transfer.zip (contains "telex transfer.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.10094.10068.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6378b34b82f8b76125969b6932758177e0b4c04a2080f334ce5846a6eeab3ac3/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-04 07:29:13 UTC
AV detection:
2 of 47 (4.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mn4lgs4c7c3wcjmwtnute5mbo7qljqckecapgngolbdkn3vlhlbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6378b34b82f8b76125969b6932758177e0b4c04a2080f334ce5846a6eeab3ac3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 6378b34b82f8b76125969b6932758177e0b4c04a2080f334ce5846a6eeab3ac3

(this sample)

SnakeKeylogger

Executable exe c95fccca993c0c82dc2cebb81669922d791e144eafddb01a1a357b0ec0f1c064

  
Dropping
MD5 f7591bbb70b3445c93445c02c8cc32ae
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c95fccca993c0c82dc2cebb81669922d791e144eafddb01a1a357b0ec0f1c064

Comments