MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 823ed2671b5d5919c61f153c87642257b44b7fe2ec5c362e1605be901ed90bad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 823ed2671b5d5919c61f153c87642257b44b7fe2ec5c362e1605be901ed90bad
SHA3-384 hash: 770bd2fc4d2446061f287343cf98a1335ecb5f381fce801d5d6082f185f5a1673c865dfb1b4a686d17eaf2d4a639e8e6
SHA1 hash: 61cc183b5ca85af7207d63bef55abcb28df732f0
MD5 hash: 2b29c3bcd8e2f2d794b67606ec61bd0b
humanhash: avocado-iowa-skylark-helium
File name:Shipping Documents Original BL, Invoice Packing List.img
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'310'720 bytes
First seen:2021-02-15 19:56:37 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:M9yCkuvgld21fNlRULtFkcmPMUHiMySw3Tznmj0ztF9CoTYUVuwwVTMsMf:M5dvTItFk7fiEjU6WYQultTE
TLSH 0355CEA822845E50DC3D777C01E4553043F7761EB732D29D7D8A70E92A63ED28B2BE1A
Reporter abuse_ch
Tags:DHL img SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: dhl.com
Sending IP: 185.239.242.232
From: DHL | Global | Forwarding<dispatch@dhl.com>
Reply-To: DHL SHIPMENT <gana@ysu.am>
Subject: DHL Shipment Notification for sales
Attachment: Shipping Documents Original BL, Invoice Packing List.img (contains "Shipping Documents Original BL, Invoice & Packing List.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.4797.26974.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/823ed2671b5d5919c61f153c87642257b44b7fe2ec5c362e1605be901ed90bad/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 08:30:45 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qi7nezy3lvmrtrq7cu6iozbck62ew77c5rodmlqwaw7jahwzbowq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/823ed2671b5d5919c61f153c87642257b44b7fe2ec5c362e1605be901ed90bad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 823ed2671b5d5919c61f153c87642257b44b7fe2ec5c362e1605be901ed90bad

(this sample)

SnakeKeylogger

Executable exe 75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606

  
Dropping
MD5 132eb1a40c403bc96986024b3de63dbb
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606

Comments