MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78e763f5b03d45e3b1a05f17f67246d7a795a37b7039aad1f1e8c20fd79b1099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78e763f5b03d45e3b1a05f17f67246d7a795a37b7039aad1f1e8c20fd79b1099
SHA3-384 hash: 4172dbf61f9b2c42aae5064cee73b5ec2a221305f31809745bb13f29d5decc304b182d9a868fe30f02fb2d055e3e01fa
SHA1 hash: 92de5a49e45776d4f2a46f6f0978ad1e88dc8138
MD5 hash: e304d9e0b5ff075137a66cda394bfb26
humanhash: carpet-four-table-bakerloo
File name:PO0900000909800.LZH
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:240'832 bytes
First seen:2021-02-07 07:40:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:1SDMjfiG5K0PMk33WanArJjJckhY9I7JDBV9ev:5WZ0PdH08kh77dBV9e
TLSH C43423EF1A4014729EE3AB33218C4384D321BD991552E5AD081E8CD5AE36BEFCB1E95D
Reporter abuse_ch
Tags:lzh


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: abdoelfarouk1@hotmail.com
Subject: Purchase Order-Date:7/05/21
Attachment: PO0900000909800.LZH (contains "PO0900000909800.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
210
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45693035.11768.6415.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78e763f5b03d45e3b1a05f17f67246d7a795a37b7039aad1f1e8c20fd79b1099/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-02-07 05:39:29 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pdtwh5nqhvc6hmnal4l7m4sg26tzli33oa42vupr5dba7v43ccmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78e763f5b03d45e3b1a05f17f67246d7a795a37b7039aad1f1e8c20fd79b1099

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 78e763f5b03d45e3b1a05f17f67246d7a795a37b7039aad1f1e8c20fd79b1099

(this sample)

SnakeKeylogger

Executable exe 8481677369aef0cd9d9fcbebe2a8f52916e4532666b1ea8e02eb046a0fa40409

  
Dropping
MD5 0f366aa151dc3a310fea6ee7255bc84c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8481677369aef0cd9d9fcbebe2a8f52916e4532666b1ea8e02eb046a0fa40409

Comments