MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 834e9c0b8061c024d5e49b8852bfe3a9b50775c2e70193dcee3169d1f47fae5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 834e9c0b8061c024d5e49b8852bfe3a9b50775c2e70193dcee3169d1f47fae5d
SHA3-384 hash: 7ca98158bb503122c94fc769fbe7326012f65ce011d490841985fe203936bfa158672062711074ba65f59d8f6caef39b
SHA1 hash: 22463f857cb46a9d50ebac103c4d245c62f1d506
MD5 hash: 0ddc288e1d1c6e235973d2c25dc78788
humanhash: hotel-maryland-paris-carbon
File name:PO - 21030901.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:775'232 bytes
First seen:2021-03-09 11:47:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:a25KsM8ck1tUpQFB8TPmIPmMM3LRyDU2KLGGS5/83Bn/29yagiULxjLz1JzADN2:a2+bcwQFB8PPkR0e+5KZOJg5xP8DI
TLSH E5F4235A4210225D745B6A678EFA1F421C2F1201FD84FA274BAF4E1BB8E721DE81F7D1
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: netway37.netway.co.th
Sending IP: 203.78.107.130
From: Sales <sales1@rojana.co.th>
Reply-To: Sales <un765454@orange.fr>
Subject: Fwd: PO - 21030901
Attachment: PO - 21030901.zip (contains "PO - 21030901- 776758374.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.2793.26797.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 11:48:07 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qnhjyc4amhacjvpetoeffp7dvg2qo5oc44azhxhogfu5d5d7vzoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/834e9c0b8061c024d5e49b8852bfe3a9b50775c2e70193dcee3169d1f47fae5d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 834e9c0b8061c024d5e49b8852bfe3a9b50775c2e70193dcee3169d1f47fae5d

(this sample)

SnakeKeylogger

Executable exe cc9e81d4ffa806c20d8c0a87ecbc0524dfcda0e60f7cdcb6d9ceb2f0ca10d2e5

  
Dropping
MD5 ddcb077742ee3ee6b7653670f76af471
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc9e81d4ffa806c20d8c0a87ecbc0524dfcda0e60f7cdcb6d9ceb2f0ca10d2e5

Comments