MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c0c4a5dbc2594be0eecda5a53f1bc6af6b7c7d3b1784a74cbe4d2062c901ac9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c0c4a5dbc2594be0eecda5a53f1bc6af6b7c7d3b1784a74cbe4d2062c901ac9
SHA3-384 hash: eeb080f8998cc0bf625766af57a20ffe289ece0b147cafe2215ceee805c6361630721c6ab71c840e6cdf139fd1e890f3
SHA1 hash: 83e045b310c4103967137cacb4cccfc982f1593d
MD5 hash: 4d47bfcf1ed0c84245a055c1731b0299
humanhash: ceiling-black-ohio-mountain
File name:IMG_13791.pdf.iso
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:2'097'152 bytes
First seen:2021-01-18 07:08:06 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:OyzF/B1cRX4Z0F3jHLrJhfoBkcIq856NxPGjhmc:TzJB1vZU7w45m1Glm
TLSH CEA59D06D11D4153D9103CB9885F2F9C4745DAAEE882D3C2BB0E7B2FFA91FC85A815E9
Reporter abuse_ch
Tags:DHL iso Rackspace SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp127.iad3a.emailsrvr.com
Sending IP: 173.203.187.127
From: invoicequery@dhl.com
Subject: DHL STATEMENT OF ACCOUNT - 1400544966
Attachment: IMG_13791.pdf.iso (contains "IMG_13791.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c0c4a5dbc2594be0eecda5a53f1bc6af6b7c7d3b1784a74cbe4d2062c901ac9/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 05:20:40 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rqgeuxn4ewkl4dxm3jnfh4n4nl3lpr6twf4eu5gl4tjamleqdleq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8c0c4a5dbc2594be0eecda5a53f1bc6af6b7c7d3b1784a74cbe4d2062c901ac9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso 8c0c4a5dbc2594be0eecda5a53f1bc6af6b7c7d3b1784a74cbe4d2062c901ac9

(this sample)

SnakeKeylogger

Executable exe db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

  
Dropping
MD5 52254e42523afbd28c7377c6b7f82cc0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

Comments