MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f7bfdce0d7ce107a62137dc446b7325cb7d7cfeb5ef97b51085d4ef9d4695dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f7bfdce0d7ce107a62137dc446b7325cb7d7cfeb5ef97b51085d4ef9d4695dd
SHA3-384 hash: 8933b607c84da0bf5b7dc6ba3b0090459a43e283bc99dad1e6a062e68610becf1d6c2d48220578f3beaa9df75eb2ecd5
SHA1 hash: 082bd07e8a2edab6276cce294ddafd75f17472d4
MD5 hash: 995efcdf49fe1af7920f73489e865ef0
humanhash: pizza-beryllium-four-eleven
File name:MV Rising Sun vessel details.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:14'225 bytes
First seen:2022-06-18 17:41:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 192:8RgDgLoBdM1wJBDXLIA2lMieG91kdcR1ZTXTnTDZD4nxJdmhHi:1DZ4ABDXLIAGMskdETX7V4nDqi
TLSH T16952C09485268132B466E9E30D8C656B4BD3F8E41D21D796402AB8D471FA0FCF23F9E4
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "TRAFIGURA <dryoperations@trafigura.com>" (likely spoofed)
Received: "from trafigura.com (unknown [193.233.185.115]) "
Date: "17 Jun 2022 16:07:43 +0200"
Subject: "MV RISING SUN / DISCHARGE PORT AGENT APPOINTMENT"
Attachment: "MV Rising Sun vessel details.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
302
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f7bfdce0d7ce107a62137dc446b7325cb7d7cfeb5ef97b51085d4ef9d4695dd/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2022-06-17 08:17:10 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
13 of 26 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n5573tqnptqqpjrbg7oei23texfx27h6wxxzpniqqxko7hkgsxoq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220618-v9zz7sche8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6f7bfdce0d7ce107a62137dc446b7325cb7d7cfeb5ef97b51085d4ef9d4695dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 6f7bfdce0d7ce107a62137dc446b7325cb7d7cfeb5ef97b51085d4ef9d4695dd

(this sample)

SnakeKeylogger

Executable exe c3e307473b646c9d66418ee95ec81bd2395ec3cf4a52c9df63b32a5352b460d8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3e307473b646c9d66418ee95ec81bd2395ec3cf4a52c9df63b32a5352b460d8
  
Dropping
SnakeKeylogger

Comments