MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 805813d975f8bd6e7d867c3ff6b589c77939393d5edea5f9e4d4a7ab224eba8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 805813d975f8bd6e7d867c3ff6b589c77939393d5edea5f9e4d4a7ab224eba8b
SHA3-384 hash: 8f1a2ab8371f4cb19155feed58fe7052fb451ef53aceda7fe9496910a477afc74ea4a654b52b579da521a595dab95ce9
SHA1 hash: 2c913d8877c036582528c53fd0915fd462e92c5b
MD5 hash: 1fdf46cbfea29097f35ba5f52eee2191
humanhash: four-quebec-neptune-idaho
File name:PURCHASE ORDER-34002174, pdf.iso
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:888'832 bytes
First seen:2021-04-07 11:25:02 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:X/w2av/OunLiN8+LLq3XYlD2vB2dNMVxEqldd:X/wXm2LiN8oL6o92J2XMVOql
TLSH 6515F1216B985B90E43E673A0531645143F2BE6ED736DA0E7DCC72CE2B37A448673B12
Reporter abuse_ch
Tags:iso SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cloudhost-75426.au-south-1.nxcli.net
Sending IP: 103.224.90.79
From: fraunhofer <brusselsoffice@zv.fraunhofer.de>
Subject: FATURA İÇİN SATIN ALMA SİPARİŞİ
Attachment: PURCHASE ORDER-34002174, pdf.iso (contains "PURCHASE ORDER-34002174, pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts66.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/805813d975f8bd6e7d867c3ff6b589c77939393d5edea5f9e4d4a7ab224eba8b/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 11:25:08 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qbmbhwlv7c6w47mgpq77nnmjy54tsoj5l3pkl6pe2st2wisoxkfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/805813d975f8bd6e7d867c3ff6b589c77939393d5edea5f9e4d4a7ab224eba8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso 805813d975f8bd6e7d867c3ff6b589c77939393d5edea5f9e4d4a7ab224eba8b

(this sample)

SnakeKeylogger

Executable exe cdbd526134259454bf3f7c9d9d81ad12a301f2d207347c201cef21e188fbf924

  
Dropping
MD5 d896b1f95f3aadad88c47bb0ecf74f4d
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdbd526134259454bf3f7c9d9d81ad12a301f2d207347c201cef21e188fbf924

Comments