MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 839500ec6181ea0ec3d83b995a9c828c91aeff391e8f0acd8c3774e15e50043d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 839500ec6181ea0ec3d83b995a9c828c91aeff391e8f0acd8c3774e15e50043d
SHA3-384 hash: 834ee3d1c5377d49e3569c3ad9386f947fd02fe40e2b541f1479a603c799eec7d18f7fcd6b942d166a7d71f0b6974f44
SHA1 hash: aad48a8fb64bec6bf8cc6d2aaa4de289428f814c
MD5 hash: 0a32a024286fbfd06d63d094ab7af599
humanhash: zebra-kilo-pip-bluebird
File name:C103-202005514-05,PDF.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:282'454 bytes
First seen:2021-01-20 13:49:27 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:Ka47ySyUKt+N5uVx9bbNw+sZPCEbS0VkBDeDX8gtbOJ0em:v4eNm52bbuDPCcZadeDM9JY
TLSH 455423ECDE36283753F126B233B0C68BD51DB10183F8458E65F8D69F228D73A6468979
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.st-nizier.com
Sending IP: 37.187.12.112
From: DESCOMBES Annick <a.descombes@alyl.fr>
Reply-To: DESCOMBES Annick <satcpark@homemail.com>
Subject: Proforma + COA as requested
Attachment: C103-202005514-05,PDF.gz (contains "C103-202005514-05,PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.507.13717.22191.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/839500ec6181ea0ec3d83b995a9c828c91aeff391e8f0acd8c3774e15e50043d/
Threat name:
ByteCode-MSIL.Trojan.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2021-01-20 13:50:08 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qokqb3dbqhva5q6yhomvvhecrsi257zzd2hqvtmmg52ocxsqaq6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/839500ec6181ea0ec3d83b995a9c828c91aeff391e8f0acd8c3774e15e50043d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 839500ec6181ea0ec3d83b995a9c828c91aeff391e8f0acd8c3774e15e50043d

(this sample)

SnakeKeylogger

Executable exe cdc918638a38eb856105db8b22281142b5cc58f6538ad4e848e45d552332b5fd

  
Dropping
MD5 eedd3f21579280588e987a0431315356
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdc918638a38eb856105db8b22281142b5cc58f6538ad4e848e45d552332b5fd

Comments