MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 770f2b469ad6890e768c804a9d694f74bfd0bb0a60149c3564bc35c1ef715c13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 770f2b469ad6890e768c804a9d694f74bfd0bb0a60149c3564bc35c1ef715c13
SHA3-384 hash: 39c92c5a83f0c5a074afce5e31bada8d8a6398b9d6982faf26ba975c638ddc11d4b5065cac6b725036821041e7db4201
SHA1 hash: 9773b0443c6de27bf1022061817408b5c7a11be3
MD5 hash: a9defb9975fa7ede715719b06e103242
humanhash: thirteen-zulu-alaska-yellow
File name:G00002.z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:752'136 bytes
First seen:2021-02-22 19:02:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:G9YmXB+HV8ha2Of3NHyGAxcMrx8/FpKLH86Z2c67Fx7X857L1yfnaQWtY4RLzpv4:MYSAh1AFUpKD2cOFxjYwaQz41zW
TLSH 49F4237A964C0DEE379EE6B8E77486134AFAD0F845CB65507588FE5C0CF90085F2887A
Reporter abuse_ch
Tags:ESP geo SnakeKeylogger z


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: vps.aberalunim.xyz
Sending IP: 203.159.80.134
From: Sales <office@aberalunim.xyz>
Subject: Cotización factura-22/02/2021
Attachment: G00002.z (contains "GPP.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/770f2b469ad6890e768c804a9d694f74bfd0bb0a60149c3564bc35c1ef715c13/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-22 19:02:10 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4hswru222eq45umqbfj22kpos75boykmakjynlexq24d33rlqjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/770f2b469ad6890e768c804a9d694f74bfd0bb0a60149c3564bc35c1ef715c13

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 770f2b469ad6890e768c804a9d694f74bfd0bb0a60149c3564bc35c1ef715c13

(this sample)

SnakeKeylogger

Executable exe 38764c9294a65e753c60fbdd48ad9863d1213fb662ba58a1eab5953d4571b337

  
Dropping
MD5 5f46accf15021a397943f67cbe755c28
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38764c9294a65e753c60fbdd48ad9863d1213fb662ba58a1eab5953d4571b337

Comments