MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 728ef2a64a4d0f892eba9c91c7b3cda8d76adb093747a307277807782fb50d8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 728ef2a64a4d0f892eba9c91c7b3cda8d76adb093747a307277807782fb50d8c
SHA3-384 hash: c845a9d69951b7e4a7f222919dee4d55672236f91ca24dbf420b55ec09657f9c94fef7887808c44d0ddeb0cf683ee31d
SHA1 hash: d5c65dee4aa562acc1806d734cc74c50d78b674f
MD5 hash: 791a8a2c3ba4e40f4f39139d7f30a00f
humanhash: cold-mexico-robin-eight
File name:DHL Notification-pdf.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:882'233 bytes
First seen:2021-07-26 14:23:43 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:mnoqWjnfp5bSZRoxIAcAyoUBEKcCm9bvjS:tqafptIUpe
TLSH T15B1533DD59EBA05DBE7FD0D6DCA621860429113AFDF4B3081829FFAE71E0166C512E0B
Reporter cocaman
Tags:DHL gz SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "ycm82820985 <ycm82820985@vip.126.com>" (likely spoofed)
Received: "from vip.126.com (unknown [185.222.57.90]) "
Date: "26 Jul 2021 14:33:23 +0200"
Subject: "New DHL Shipping Notification!"
Attachment: "DHL Notification-pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.ZmutzyPong
Create hunting rule
Status:
Malicious
First seen:
2021-07-26 14:24:10 UTC
File Type:
Binary (Archive)
Extracted files:
59
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=okhpfjskjuhyslv2tsi4pm6nvdlwvwyjg5d2gbzhpadxql5vbwga._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210726-txzqdkhgds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
CustAttr .NET packer
Snake Keylogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/728ef2a64a4d0f892eba9c91c7b3cda8d76adb093747a307277807782fb50d8c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 728ef2a64a4d0f892eba9c91c7b3cda8d76adb093747a307277807782fb50d8c

(this sample)

SnakeKeylogger

Executable exe 9906d7c05680fc4b3e9c741e5c95d6c8acbd88f7ded4b451270cdfa7c8847c30

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9906d7c05680fc4b3e9c741e5c95d6c8acbd88f7ded4b451270cdfa7c8847c30

Comments