MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 684b084150230e5c629a4c5e6f43f540cc207cfb4f0d20adcaaa60b100d796a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 684b084150230e5c629a4c5e6f43f540cc207cfb4f0d20adcaaa60b100d796a6
SHA3-384 hash: baa6dfa4262692e52328659b131c4a1bf30ab3c66fa9cba90f190db96b648c234d68ce60aef498d361bf454dc3bfe427
SHA1 hash: 85ace292032545cbdb3398b4c6c85ad130d08bc1
MD5 hash: acab4dcda1adc893181127e37ceb3783
humanhash: football-kitten-one-green
File name:SHIPPING DOCUMENTS.IMG
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'441'792 bytes
First seen:2021-02-17 13:31:58 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:PbyF6l3CgdOyrhbBSvpNX6VkbWLYLPnAHizOS8RgV1ZEmKMOhqfJo1mJxRHHE6mx:Pbxfb276z3CSSJSM8qfJYOW
TLSH 6265D0337391CE66C4695B798120E3F403F8DE12561BE24B786D3927BE72D874B19AC2
Reporter abuse_ch
Tags:DHL img SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: vm1-bio.netprotect.ro
Sending IP: 185.99.89.68
From: DHL EXPRESS (MK) <noreply@dhl.com>
Reply-To: result.box2019@mail.com
Subject: DB_DHL_AWB_00117390021 / AD
Attachment: SHIPPING DOCUMENTS.IMG (contains "SHIPPING DOCUMENTS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.29592.6817.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/684b084150230e5c629a4c5e6f43f540cc207cfb4f0d20adcaaa60b100d796a6/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 13:32:08 UTC
AV detection:
8 of 44 (18.18%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbfqqqkqemhfyyu2jrpg6q7vidgca7h3j4gsblokvjqlcagxs2ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 684b084150230e5c629a4c5e6f43f540cc207cfb4f0d20adcaaa60b100d796a6

(this sample)

SnakeKeylogger

Executable exe bccc9e3d756a755324883a0587184066522a027831dc451f0ccdc9a4162c95a2

  
Dropping
MD5 ee5cb738f933fea4e1b0ec877e3f31de
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bccc9e3d756a755324883a0587184066522a027831dc451f0ccdc9a4162c95a2

Comments