MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f3041b6887bea478c24a960cbd53818532152081b186ef5dcc09a8e20e195ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f3041b6887bea478c24a960cbd53818532152081b186ef5dcc09a8e20e195ef
SHA3-384 hash: 231c2a26badf08a9db44fe16cbb74d90d09e61511507d7c6636fc7d9bae56aa399c4dd5d5f9b19f2f86cac768e84ee8f
SHA1 hash: 0ea74fc36a899832b10a65f93c91860f44af5ad5
MD5 hash: 3539a222fc01b61671d6b3e39a7a333b
humanhash: undress-hotel-pizza-princess
File name:191017_SQ004737-4_REV_Quotation_TD90_INF1805_003, pdf.CAB
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:458'724 bytes
First seen:2021-03-10 07:54:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:YZjh8L7EyYzBXfhGXuQPC7EiHwU3H3cXmQzcWEBPA:YZjmGGC7x933cHchlA
TLSH 85A4231813B23E2E5A423167FF1DA122F8EDB9358CBDE1218F89157494B4F2A50B497B
Reporter abuse_ch
Tags:cab SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: box0.bltcirciutservices.co.uk
Sending IP: 143.110.236.48
From: Cheyenne Lemke <info@bltcirciutservices.co.uk>
Reply-To: Cheyenne Lemke <sata_export@satatools.com.sg>
Subject: QUOTATION TO BE UPDATED FOR A PROJECT
Attachment: 191017_SQ004737-4_REV_Quotation_TD90_INF1805_003, pdf.CAB (contains "191017_SQ004737-4_REV_Quotation_TD90_INF1805_003, pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 04:24:00 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p4yednuippvepdbevfqmxvjydbjscuqidmmg55o4ycni4ihbsxxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/7f3041b6887bea478c24a960cbd53818532152081b186ef5dcc09a8e20e195ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 7f3041b6887bea478c24a960cbd53818532152081b186ef5dcc09a8e20e195ef

(this sample)

SnakeKeylogger

Executable exe f53664934ab27fc783bb852757bbf36152785b41d5434eba53774050eab19ed6

  
Dropping
MD5 44d4bde902c128dde3b09786d5576ed8
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f53664934ab27fc783bb852757bbf36152785b41d5434eba53774050eab19ed6

Comments