MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 666031b246fa09b48b2720809a71b75aa98838eee9df74827d3efb68c00962cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 666031b246fa09b48b2720809a71b75aa98838eee9df74827d3efb68c00962cd
SHA3-384 hash: c0792ad2fe98663b454eb2d78027adb1bb2c7d71b10a2afe6503de5b6c3256fb899ae50ae336e12e939a70e98a3357c8
SHA1 hash: 812be2b46c0b8f3cdf1fe96a6608eda6dc43727a
MD5 hash: fba477b1f172ea343a0d37cde5924a90
humanhash: mars-artist-earth-queen
File name:Lorom India Order Acknowledgment.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:448'098 bytes
First seen:2021-03-05 13:05:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:a427EyiP2rMH+A93qs0QmbJ1XpwSmPLiRBgrkAhO:adEaIf3qJbJ1XpRmuwhO
TLSH 399423AE3A9F9343176A7779A9933A524439B8744FCC28227FED02758B3B10801CF578
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: contentkenya.com
Sending IP: 69.160.44.71
From: Amit Kumar <india-purchase01@lorom.com>
Reply-To: katy.cherbroo@hotmail.com
Subject: Fwd: AW: New order
Attachment: Lorom India Order Acknowledgment.zip (contains "Lorom India Order Acknowledgment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.13061.10520.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/666031b246fa09b48b2720809a71b75aa98838eee9df74827d3efb68c00962cd/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 13:05:13 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzqddmsg7ie3jczhecaju4nxlkuyqoho5hpxjat5h35wrqajmlgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/666031b246fa09b48b2720809a71b75aa98838eee9df74827d3efb68c00962cd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 666031b246fa09b48b2720809a71b75aa98838eee9df74827d3efb68c00962cd

(this sample)

SnakeKeylogger

Executable exe d7036cc5c9cc8d91b86cdd451ecb84351b19c1670b4f34b39190efdb3b7a82d5

  
Dropping
MD5 0e68ad3ae6325eb81463d1934cc3ad2e
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7036cc5c9cc8d91b86cdd451ecb84351b19c1670b4f34b39190efdb3b7a82d5

Comments