MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76b2f6e0d60310ea7c6a44ac62dbd253e3bb8fc0003a761bfc4085668f97e1f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76b2f6e0d60310ea7c6a44ac62dbd253e3bb8fc0003a761bfc4085668f97e1f0
SHA3-384 hash: 69e36b72b176beaf4a32c6808b30fc0f5390e2d087fb9108f7b27ebd7ab9b82dddfe7ff8bb10f92efe566018f6df9555
SHA1 hash: 5850205fbb6bfa7c8ae00adb53609f15289bedeb
MD5 hash: 42bf04f09192ca1302a41411496f1f75
humanhash: yellow-single-equal-green
File name:Hyundai Engineering_EOSE BID.doc.xxe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:333'354 bytes
First seen:2021-02-17 13:35:36 UTC
Last seen:Never
File type:
MIME type:application/x-7z-compressed
ssdeep 6144:vKoPkxUCStVn4CsxetbthwWdBhBvoBiI9/Oa8Tc0HtmkW1MlQPQrLd++A6:ioBtV4UZviiI9/GNmFSaoHdPb
TLSH 9C642323B8E76976FE6D93DFAE9B67C4CB401D8AFFA5F2E80D5092D148211F24019C94
Reporter abuse_ch
Tags:SnakeKeylogger Xxe


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: upbeat-moser.91-92-128-140.plesk.page
Sending IP: 91.92.128.140
From: Jae-Gun Yooj <j-gyoo@hec.co.kr>
Subject: Hyundai Engineering_EOSE] Invitation to bid for Construction Work_SS
Attachment: Hyundai Engineering_EOSE BID.doc.xxe (contains "VIIIIIIIIIIIIIC.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.450.9805.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76b2f6e0d60310ea7c6a44ac62dbd253e3bb8fc0003a761bfc4085668f97e1f0/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 13:36:10 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2zpnygwamiou7dkiswgfw6skpr3xd6aaa5hmg74iccwnd4x4hya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

76b2f6e0d60310ea7c6a44ac62dbd253e3bb8fc0003a761bfc4085668f97e1f0

(this sample)

SnakeKeylogger

Executable exe 0e9eb5629f6dd0dd189611f4ab09ba17b547d23f355373cb9864216726fb0a37

  
Dropping
MD5 08d48d8422fd58adc747356935c9f7e4
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e9eb5629f6dd0dd189611f4ab09ba17b547d23f355373cb9864216726fb0a37

Comments