MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a05223b1f1cf451de80f5c15b89022742110c19f4dc0efb0992042a4d5f5f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a05223b1f1cf451de80f5c15b89022742110c19f4dc0efb0992042a4d5f5f86
SHA3-384 hash: c9b1499af87f99bdaeaa136adddbdeab46bc1bbd97593c43f013bd45efbc29df862360fe589d0fbdcda39674544891e1
SHA1 hash: 820164d63dc78560e112d72f2d50c1629c49d5b3
MD5 hash: 0ac7fd26984f1ab5ff7572a3a4c2c0b7
humanhash: saturn-nitrogen-nine-low
File name:Dekont.pdf.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:13'304 bytes
First seen:2021-02-25 10:09:23 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:vccICFNPjTGeg4ID8TfyGfSzuMytCm7X1:v9IC/PfGLP8Tf1fbLtCg
TLSH 4F52C09CCC6A1C2D2411DCF85CCD0A3264861BA6A12FB948B04DFF7868E53D646DB45D
Reporter abuse_ch
Tags:geo gz SnakeKeylogger TUR


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: smtp-02-9759.kriter.com.tr
Sending IP: 81.22.97.59
From: Furkan Taşkıran <furkan@idealofset.com>
Subject: Dekont.pdf
Attachment: Dekont.pdf.gz (contains "Dekont.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a05223b1f1cf451de80f5c15b89022742110c19f4dc0efb0992042a4d5f5f86/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 10:10:09 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=picseoy7dt2fdxua6xavxcice5bbcdaz6toa56yjsiccutk7l6da._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 7a05223b1f1cf451de80f5c15b89022742110c19f4dc0efb0992042a4d5f5f86

(this sample)

SnakeKeylogger

Executable exe df91e0af99535b6c1c6f35d9e7a669587a26de1222dcabad5c3528de856a1f6a

  
Dropping
MD5 12d65cd1c02de9d1a7bbd0919a82b88f
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df91e0af99535b6c1c6f35d9e7a669587a26de1222dcabad5c3528de856a1f6a

Comments