MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88ce6a707b5763bffbe467fdb969365bc44f134c8ee2c3a1f342aba479c80c45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88ce6a707b5763bffbe467fdb969365bc44f134c8ee2c3a1f342aba479c80c45
SHA3-384 hash: 13e386d31d180144fd4dcc322700799ca1ac1c78a8629736611fa23061863299876925caab9b975183f709a7e64bc6cb
SHA1 hash: 946719a3b6066cc6b9206451e3229a4c1f36f039
MD5 hash: 813b406d6750a3e639272d5c6af4b00b
humanhash: paris-east-ten-fish
File name:DHL_FORM_9950983745_PDF.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:704'748 bytes
First seen:2021-02-11 07:21:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:KeNLk/a//C+u8hcMrEbRLgqoOUY2imO2KOQ0lSYXdiGpM9veJzeeYOj5Rb31A+:5N4C3C+zgbaq2io00lNRS9veJv
TLSH F5E4333B86EBCC46F5FAB474B8C6802145F07726665B57DDE8441FE423E019AB0E0B3A
Reporter abuse_ch
Tags:DHL rar SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: d354.x-mailer.de
Sending IP: 46.229.46.58
From: DHL EXPRESS (PL) <noreply@dhl.com>
Reply-To: result.box2019@mail.com
Subject: DOSTAWA DHL (POWIADOMIENIE O NIEPOWODZENIU)
Attachment: DHL_FORM_9950983745_PDF.rar (contains "DHL_FORM_9950983745_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88ce6a707b5763bffbe467fdb969365bc44f134c8ee2c3a1f342aba479c80c45/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-11 10:20:02 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdhgu4d3k5r3767em763s2jwlpce6e2mr3rmhiptikv2i6oibrcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88ce6a707b5763bffbe467fdb969365bc44f134c8ee2c3a1f342aba479c80c45

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 88ce6a707b5763bffbe467fdb969365bc44f134c8ee2c3a1f342aba479c80c45

(this sample)

SnakeKeylogger

Executable exe 9dde30eea4bc51f6561d857ecb624f09e3257c3a015ff49a8f22f206fcab45c1

  
Dropping
MD5 4d4865d8ecb8303a15c99e9ed44e54f9
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9dde30eea4bc51f6561d857ecb624f09e3257c3a015ff49a8f22f206fcab45c1

Comments