MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f49a2ce9af3a6695783c6ef469161c64613c5d1f640c09b2b13fa912e41d3fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f49a2ce9af3a6695783c6ef469161c64613c5d1f640c09b2b13fa912e41d3fb
SHA3-384 hash: 3d79332696636b262b69a14dedc97ea5697c65fa1b71f139ca2b35b845ecdf16edaa3f1424ca52aad1657a39ebc9199d
SHA1 hash: 20ee88bae975bd3b290240f27cd8546ff992af57
MD5 hash: 6cc65d13a4b0523dcd6a5f49aff93da1
humanhash: yankee-mississippi-paris-berlin
File name:PRODUCTS ENQUIRY.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:382'650 bytes
First seen:2021-02-23 15:55:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:E3i6qsvJkgGx6CB5f0f9g6iHDnoI44mIr7PcXzfow0lJp/jKPJcj3uaH+vQvhoPz:sJ/jgf0f9Gjf44XcjgKeLH+j/bvly/4
TLSH 0F8423445D662EB1C3B9DED16C135B46E43FE11DE5801BBBD2B329039AFBA36061B342
Reporter abuse_ch
Tags:rar SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: smtp-gw.fpcci.org.pk
Sending IP: 124.29.202.102
From: MAX EXPORT TRADING COMPANY LTD <sales@millbakers.com>
Reply-To: ''maxexport.tradingintcompanyltd@inbox.ru'' <cbuccioliatlgroupit@vivaldi.net>
Subject: PRODUCTS ENQUIRY
Attachment: PRODUCTS ENQUIRY.rar (contains "PRODUCTS ENQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f49a2ce9af3a6695783c6ef469161c64613c5d1f640c09b2b13fa912e41d3fb/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 12:07:35 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p5e2ftu26otgsv4dy3xunelbyzdbhror6zambgzlcp5jclsb2p5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f49a2ce9af3a6695783c6ef469161c64613c5d1f640c09b2b13fa912e41d3fb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 7f49a2ce9af3a6695783c6ef469161c64613c5d1f640c09b2b13fa912e41d3fb

(this sample)

SnakeKeylogger

Executable exe a9cfc82275c444c42daab12cf5763899d90a951042412fe78245aa2ceaf72115

  
Dropping
MD5 5282d2178c05a57641d935b1bdd4f753
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9cfc82275c444c42daab12cf5763899d90a951042412fe78245aa2ceaf72115

Comments