MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b40042b8617907345c96da6ef7923fca7f3c2baf3e441f9a4d477dd6cb2083c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b40042b8617907345c96da6ef7923fca7f3c2baf3e441f9a4d477dd6cb2083c
SHA3-384 hash: f7d8461e75d427e9d73cd832cfd3cbb923ed7efebbc5c32f64eda546ad9c0303e1d374dae50cf142dd40f2df03534d94
SHA1 hash: 873954e1b5dacb064bf3ffc603e14a56760aa471
MD5 hash: 93c064a70992f08187e469390205db10
humanhash: music-autumn-march-december
File name:QWP-0716.xls.ISO
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'376'256 bytes
First seen:2021-01-07 08:17:08 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:fwmIPJQojoJEFQY3ryrLD4ffM5smgYpG:qPyo8JEFh3ryrf4ffM5sR
TLSH EB559149E304C6D8D9607B3735A57A2B0337FCE36928DAC96A2C79E2D6730C13A5D5C8
Reporter abuse_ch
Tags:iso SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mo4-p02-ob.smtp.rzone.de
Sending IP: 85.215.255.81
From: Nguyen Trong Trinh (Mr.) <sales3@labedulnatours.com>
Reply-To: sales3@labedulnatours.com
Subject: Re: CARGO SHIPPING REQUEST
Attachment: QWP-0716.xls.ISO (contains "QWP-0716.xls.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.18083.32198.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b40042b8617907345c96da6ef7923fca7f3c2baf3e441f9a4d477dd6cb2083c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 19:38:11 UTC
AV detection:
4 of 45 (8.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rnaaik4gc6ihgrojnwto66jd7st7hqv26psed6ne2r3523fsba6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8b40042b8617907345c96da6ef7923fca7f3c2baf3e441f9a4d477dd6cb2083c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso 8b40042b8617907345c96da6ef7923fca7f3c2baf3e441f9a4d477dd6cb2083c

(this sample)

SnakeKeylogger

Executable exe bd4bbfaa22dc3cb00b5cbc8b64868b80ca02609fce5ddd910b289a9a06f1ed53

  
Dropping
MD5 24ce9270950ad2bf6be0bd1c5056aeef
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd4bbfaa22dc3cb00b5cbc8b64868b80ca02609fce5ddd910b289a9a06f1ed53

Comments