MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d3dd33b96b6a21ac8d28d5aa7a16514c4c22502f597e1a55393b1014d1b18d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d3dd33b96b6a21ac8d28d5aa7a16514c4c22502f597e1a55393b1014d1b18d6
SHA3-384 hash: d6353cb43855a834a24f2e28984a73a9e3ecdcbec17a4f6acc118886d5eb0f66486463b080a6c6677fd06a1496becb8e
SHA1 hash: 7b45d007badc54f3247ad4fe5b6c7667279308a0
MD5 hash: daeadfd792bf872e0c65d492dbbcfdba
humanhash: cardinal-robert-april-uranus
File name:SALES0900000000UU-.UUE
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:300'834 bytes
First seen:2021-02-11 10:05:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:7V9tEdPtmX5MQvQlkAyYKFsdEzPLkt0Wpm/2rNyIWQVqu+iJpH9:JbEZtmpBvQlk9rEIPGjRyIPNpH9
TLSH 0154239C2917922AB96043B903FB93561095BDAB83DC57B7004B7EDFC854D0B98E6E0F
Reporter abuse_ch
Tags:uue


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.107
From: Handelele Maciej Siemiński <handlele@gmail.com>
Subject: فاتورة المبيعات
Attachment: SALES0900000000UU-.UUE (contains "0900000000-.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.12325.23685.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d3dd33b96b6a21ac8d28d5aa7a16514c4c22502f597e1a55393b1014d1b18d6/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-11 09:18:44 UTC
AV detection:
3 of 47 (6.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nu65go4ww2rbvsgsrvnkpilfctcmejic6wl6djktsoyqcti3ddla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 6d3dd33b96b6a21ac8d28d5aa7a16514c4c22502f597e1a55393b1014d1b18d6

(this sample)

SnakeKeylogger

Executable exe 6b9e1bca96e339ae343b831d44dae8f7c876ba09d853a86e79bb85b397856965

  
Dropping
MD5 0305a62e320e577da903aa94c434be39
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6b9e1bca96e339ae343b831d44dae8f7c876ba09d853a86e79bb85b397856965

Comments